The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The scripts index_updater.py and task_formatter.py allow for indirect prompt injection by placing user-provided task metadata into documentation files that the agent relies on for session context.
Ingestion points: description and status arguments in functions/index_updater.py; title, priority, complexity, and status arguments in functions/task_formatter.py.
Boundary markers: Absent. Input strings are placed directly into markdown templates without protective delimiters or instructions to ignore embedded commands.
Capability inventory: functions/index_updater.py has the capability to write to the local file system (.agent/DEVELOPMENT-README.md).
Sanitization: No validation or escaping of markdown control characters is performed on user inputs, allowing an attacker to inject arbitrary markdown structures or instructions.

nav-task