The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting and acting upon external PRDs and referenced files, which presents an attack surface for indirect prompt injection. A malicious PRD could include hidden instructions to compromise the system or codebase.
Ingestion points: The skill is instructed to locate and read the PRD and any referenced files (as detailed in SKILL.md and README.md).
Boundary markers: There are no explicit boundary markers or "ignore instructions" warnings defined to separate the untrusted PRD data from the agent's task instructions.
Capability inventory: The skill is granted powerful capabilities including Read, Write, Edit, Bash, Grep, and Glob (SKILL.md).
Sanitization: The skill lacks sanitization or validation mechanisms for the content it extracts from the external documents before implementing changes or executing commands.
Autonomy Risk: The skill explicitly instructs the agent to bypass human confirmation for many actions: "Ask the user only when a missing choice would materially change behavior... continue without a redundant confirmation round." This reduces the user's opportunity to intercept malicious actions triggered by an injected prompt.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform codebase consistency checks (e.g., executing grep to find patterns). While intended for architectural alignment, this shell access provides a potential execution vector if the processed PRD content influences the command arguments or search patterns.

prd-implementation-precheck