The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context markers to execute git status, git branch, ls, and cat commands when the skill is loaded. These commands are used to provide the agent with current repository status and configuration. These operations are benign and consistent with the skill's purpose as a developer implementation tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from specification files that may contain instructions influencing its code implementation logic. This represents a potential vulnerability if a spec file contains malicious patterns meant to override agent behavior.
Ingestion points: Content of files located within the specs/ directory.
Boundary markers: None; the agent is instructed to follow the implementation plan found within the spec files directly.
Capability inventory: The skill has access to file writing (Write, Edit) and git management tools (git branch, git checkout).
Sanitization: None.
Mitigation: The skill includes explicit instructions to pause for human review after every implementation step and requires manual confirmation before creating branches, significantly reducing the risk of autonomous malicious actions.

spec-impl