The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and acts upon an external 'approved plan' and existing repository content. These sources are considered untrusted data and could contain malicious instructions that override the agent's intended behavior.
Ingestion points: Reads the implementation plan and repository files such as affected code, build scripts, and tests (SKILL.md).
Boundary markers: The instructions lack specific guidance on using delimiters or markers to separate ingested plan content from instructions, which increases the likelihood of the agent obeying embedded commands.
Capability inventory: The skill includes the Bash tool for execution and the Write tool for file modifications, creating a high-impact surface if instructions are manipulated.
Sanitization: No sanitization, validation, or filtering of the implementation plan's content is described.
[COMMAND_EXECUTION]: The skill grants the agent the ability to use the Bash tool to run repository-defined checks, build targets, and other scripts. While required for software development, this capability could be exploited to execute arbitrary shell commands if the agent is misled by a malicious implementation plan or compromised build configuration.

execution