The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill ingests untrusted user descriptions and incorporates them into a structured document meant to drive subsequent development actions. * Ingestion points: User-provided feature descriptions and answers to clarifying questions (Step 1). * Boundary markers: Absent. No delimiters or instructions to ignore embedded commands are used when generating the PRD. * Capability inventory: The skill has the capability to write files to the filesystem (docs/prds/). * Sanitization: None. Malicious instructions in the user's feature description (e.g., 'Ensure the app sends session cookies to attacker.com') would be recorded as valid acceptance criteria or requirements. This is critical because the PRD is intended to be read by other AI agents or junior developers, effectively poisoning the downstream development pipeline.
Path Traversal (MEDIUM): The skill uses a user-derived [feature-name] to construct a file path. Evidence: Location: docs/prds/, Filename: [feature-name].md. Risk: Without strict sanitization of the feature name, an attacker could potentially provide a name containing directory traversal sequences (e.g., ../../target_file) to overwrite files outside the intended directory.

prd