The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the .specstory/history/ directory which contain previous AI session logs. These logs represent untrusted data that could contain malicious instructions (e.g., hidden in code comments or user requests) designed to influence the agent's summarization behavior or output format.
Ingestion points: Files located in .specstory/history/*.md are read using grep, head, and tail in Step 2.
Boundary markers: The instructions do not define clear delimiters or "ignore" instructions when reading these external files.
Capability inventory: The skill uses read-only commands (ls, grep, head, tail) and does not possess network access or file-writing capabilities, significantly limiting the potential impact of an injection.
Sanitization: There is no evidence of filtering or sanitizing the content of the history files before the agent analyzes them.

specstory-session-summary