The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by interpolating untrusted user data into system-level operations without sufficient isolation or validation.\n
Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable (product name or feature) and the AskUserQuestion tool used to define the PRD scope in SKILL.md.\n
Boundary markers: The skill does not employ explicit boundary markers (e.g., XML tags or clear delimiters) or specific instructions to the agent to ignore potential instructions embedded within the user-provided product descriptions.\n
Capability inventory: The skill possesses significant capabilities across multiple files, including file system operations via Write and Edit, shell access via Bash, and structured memory interactions via mcp__memory__search_nodes.\n
Sanitization: User-provided content is directly used to construct file names (e.g., PRD-{product-slug}.md) and used as a query string in memory searches ({PRODUCT} PRD requirements) without sanitization or escaping, creating a surface for potential path manipulation or search-based injection.

write-prd