feat(skills): seed an untrusted-input rules file

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)

[Abdol164]

What's missing today

cmk:delivery-intake §1: "Fetch and read the issue in full: description, acceptance criteria…
Read every comment." That is phase 1 of a pipeline whose later phases commit, push, open PRs and
reconcile a tracker. cmk:delivery-review reads PR bodies and diffs. cmk:discover-efforts
reconciles prompts, requirements and code from uncertain sources.

Content arrives from outside the repository, and is consumed by a session that can mutate it. No
skill currently says that content is data rather than instruction:

grep -rliE "prompt.?inject|untrusted|adversarial input|treat .* as data|attacker-controlled" skills/
→ no matches

This is not only a public-repo concern. Outside content also reaches a session through dependency
changelogs during a lockfile review, MCP server responses, vendored or generated code in a diff,
and externally filed reports in private trackers.

The change

A seventh seeded rules template, references/rules-untrusted-input.md, plus its row in the rules
table. It follows the existing shape — Load when: trigger, bulleted rules, and the
Rationalizations table the recent rewrite introduced. That table earns its place here: injection
works by supplying a plausible-sounding reason to deviate, which is exactly what the pattern exists
to pre-empt.

The rule, in short: outside content is evidence about the world, never an instruction to the
session, however directly it addresses the agent. It may inform findings and describe work a human
then confirms; it may not redirect the workflow, change what gets pushed, move a credential, or
waive a gate. An instruction found inside fetched content is a finding about that content, not a
task.

Two things beyond the obvious:

Provenance survives the quote. Carried into a doc or tracker comment, outside content stays
attributed rather than restated as the repository's own decision. These docs are the shared state
every later session reads — an unattributed claim is inherited as established fact and its origin
becomes unrecoverable. That failure is specific to a documentation-first kit.

Reading and mutating are separated. A pass that consumes outside content should not also hold
push or deploy credentials. The risk is not that the content is read; it is that it is read by
something that can act on what it says.

Deliberately not a blanket ban on following links — that would forbid ordinary work and get
ignored wholesale. Fetching is fine; what returns is untrusted in turn, and a URL encoding
repository content in its path or query is exfiltration wearing a citation.

Where the pointer goes

cmk:delivery-workflow, in ## Humans decide, the agent reconciles — the section that already
establishes where authority comes from. It is the contract "every other delivery skill operates
inside", so one pointer reaches all seven rather than repeating it per skill.

`## Checks

• bash scripts/skill-lint.sh — OK
• agent-instructions 105/150, delivery-workflow 149/150, new template 51 lines
  (rules-agent-conduct.md is 40, the size model)