The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted external content such as PRD text, GitHub issue bodies, and local specification files to generate executable shell commands for goal verification. This design creates a surface for indirect prompt injection, where malicious instructions embedded in the source documentation could attempt to influence the agent's behavior or manipulate the generated goal assertions.
Ingestion points: The skill accepts raw text inputs via the prd-text argument, fetches issue data using gh issue view, and reads local files.
Boundary markers: There are no explicit markers or instructions within the skill's logic to isolate or ignore potentially malicious commands embedded in the processed requirements.
Capability inventory: The skill operates within an environment where Bash, Agent, and Write tools are available, providing a functional surface for an injection to target.
Sanitization: The instructions focus on decomposing text into assertions but do not define specific sanitization or filtering steps for the untrusted input content.
[COMMAND_EXECUTION]: The skill is centered around generating and executing shell commands (e.g., test, pnpm, gh, jq) to monitor task completion. It also describes a post-timeout grader pattern that involves spawning a subagent via a shell execution of the claude platform itself (claude -p --bare). while these are legitimate uses of the platform's capabilities, they represent the execution of logic derived from external data.

prd-to-goal