The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it ingests and processes untrusted content from external sources (proposals and existing specifications) to generate its outputs.
Ingestion points: The skill retrieves proposal data using the mem_get_observation tool and reads existing domain specification files from the openspec/specs/ directory.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands embedded within the ingested documents during processing and interpolation.
Capability inventory: The skill possesses the capability to write to persistent agent memory via mem_save and to modify the project's local filesystem in openspec or hybrid modes.
Sanitization: The skill does not implement validation or sanitization procedures for the external content it processes.

sdd-spec