The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION] (LOW): The skill ingests untrusted data from local files and uses it to generate documentation.
Ingestion points: docs/product-requirements.md and docs/functional-design.md are read into the agent context in the '実行手順' (Execution Procedures) section.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt instructions.
Capability inventory: The skill is restricted to reading markdown files and writing to docs/architecture.md. It lacks network access, shell execution, or file system modification capabilities beyond the output path.
Sanitization: No sanitization or validation of input file content is performed.
Risk Assessment: Since the output is a static markdown document and the agent has no high-privilege capabilities, the impact of a successful injection is limited to producing a misleading architecture document for human review.
[COMMAND_EXECUTION] (SAFE): No subprocess, shell, or system command patterns were detected.
[DATA_EXFILTRATION] (SAFE): No network operations (curl, wget, fetch) or sensitive file path access (SSH/AWS keys) were detected.
[EXTERNAL_DOWNLOADS] (SAFE): All references are local file paths (./template.md, ./guide.md). No external URLs or remote package downloads are present.

architecture-design