The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted PRD content from local paths, remote links, or direct user input. This data is used to inform the agent's review logic and report generation. Maliciously crafted PRDs could contain instructions designed to deceive the reviewer, bias the report, or influence the agent's subsequent recommendations.
Ingestion points: The skill accepts a PRD path, link, or raw content as its primary argument in SKILL.md.
Boundary markers: While the skill provides a "Reviewer Contract" to structure subagent tasks, it lacks explicit delimiters or "ignore instructions" wrappers for the ingested PRD content.
Capability inventory: The skill possesses file read capabilities (PRD and source code), file write capabilities (saving reports and updating project ledgers), and network read access (fetching remote PRDs and documentation).
Sanitization: No specific sanitization or filtering logic is mentioned for the external content before it is processed by the model.
[COMMAND_EXECUTION]: The skill uses the rg (ripgrep) tool to search the codebase for specific implementations, routes, and business logic. This is an intended read-only capability used to verify whether PRD claims match the existing code reality.
[DATA_EXFILTRATION]: The facts review lens involves reading source code and checking external documentation or "first-hand sources." While the primary output is a local report, the ability to aggregate codebase details and then access external URLs creates a potential, though low-severity, path for data exposure if the agent is manipulated into sending sensitive snippets via network requests.

review-prd