The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-specified task files and sub-task directories. This data is then interpolated into prompts for sub-agents without sufficient boundary protection.
Ingestion points: Reads task-file in Workflow Phase 0 and individual sub-task files in .specs/sub-tasks/ during Workflow Phase 2.
Boundary markers: Absent. The prompts generated for implementation agents and the sdd:code-reviewer include these file paths/contents without delimiters or explicit instructions to ignore embedded malicious content.
Capability inventory: The skill can execute shell commands (git, ls), launch other sub-agents with varying models, and write status updates back to the task file.
Sanitization: No explicit sanitization or validation of the external task file content is mentioned before it influences sub-agent prompts.
[COMMAND_EXECUTION]: The skill instructs the agent to construct shell commands using the task-file argument, such as git mv .specs/tasks/todo/$TASK_FILE .specs/tasks/in-progress/. If the input is not strictly validated, it could lead to argument or command injection, though the orchestrator agent's natural language processing typically provides a layer of defense against such exploits.

implement-task