The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill ingests untrusted data from user test reports (verbatim responses) which are later used to prompt subagents during the diagnosis phase.
Ingestion points: references/UAT-template.md (reported field) and references/diagnose-issues.md (parse_gaps step).
Boundary markers: User input is encapsulated within YAML fields and markdown code blocks.
Capability inventory: The orchestrator can spawn subagents (Task calls), read/write files in the .planning directory, and execute git commit commands.
Sanitization: No explicit sanitization is described, but the context is limited to debugging local code.
[Command Execution] (SAFE): references/diagnose-issues.md includes shell commands for configuration checks and git operations (git add, git commit). These are legitimate and restricted to the development environment's lifecycle management.
[Dynamic Execution] (SAFE): The orchestration logic in references/diagnose-issues.md involves spawning subagents with dynamically generated prompts. This is a standard and expected mechanism for the skill's stated purpose of parallelized debugging.

kata-verify-work