The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core function is to ingest and evaluate requirements (CRDs) authored by external parties. This creates an attack surface where a malicious document could embed instructions designed to manipulate the agent's behavior during the evaluation or development planning process.
Ingestion points: The skill reads external CRD content, paths, or links provided in the initial user request (SKILL.md, Section 1).
Boundary markers: The instructions require the agent to explicitly distinguish between 'code facts,' 'external statements,' and 'hypotheses,' reducing the likelihood of accepting malicious instructions as fact (SKILL.md, Top-level Boundaries).
Capability inventory: The agent can read local source code, Git metadata, write to local documentation files, and invoke the dev-plan skill to generate development tasks (SKILL.md, Sections 1, 2, 5, 6).
Sanitization: The instructions include a strict safety directive to never include credentials, personal data, or sensitive internal implementation details in the external-facing response (SKILL.md, Top-level Boundaries).
[DATA_EXFILTRATION]: The skill performs deep inspection of the local environment, including Git branch status, commit SHAs, and the local working tree, to verify implementation details (SKILL.md, Section 1, 2). While this is intended for accurate evaluation, it involves accessing sensitive project metadata. The risk of exfiltration is mitigated by instructions that forbid writing sensitive information into the response intended for the external partner.

crd-respond