The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from .qa-learnings/ledger.md. This file is populated by external agents and skills, and its contents are used to determine what code changes to implement.
Ingestion points: .qa-learnings/ledger.md (read in Phase 1 and 2).
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands within the ledger entries.
Capability inventory: The skill uses Read, Write, and Edit tools to modify arbitrary files in the repository and commit those changes.
Sanitization: Absent. There is no validation or filtering of the observation text before it is used to plan and execute code edits.
[COMMAND_EXECUTION]: The skill's primary function includes the autonomous modification of source code and repository files based on the processed observations. While it asks for user confirmation in Phase 4, the risk remains that the agent might propose and execute malicious changes if the input ledger is compromised.

review-learnings