The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a feedback loop where the agent reads and acts upon data from an external JSON file (<plan-name>-plan-review.json). This file is populated via a web interface, creating a vector for indirect prompt injection if the content contains instructions intended to manipulate the agent's behavior during plan refinement.
Ingestion points: The agent reads the review JSON file as instructed in SKILL.md ("read the review file. It has an overall summary and comments... Fold in any comments").
Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore embedded instructions within the comments.
Capability inventory: The agent has the ability to write to the file system (to update plans and HTML templates) and execute shell commands (to start the review server).
Sanitization: There are no explicit instructions for sanitizing or validating the comment content before the agent processes it.
[COMMAND_EXECUTION]: The skill requires the agent to run a local Python server script provided within the skill's directory.
Evidence: SKILL.md provides the command: python3 <skill-dir>/scripts/review_server.py <plan-name>-plan-review.html.
Context: The script serves a generated HTML page on 127.0.0.1 to facilitate a local review process. The server's functionality is limited to serving the specific review file and handling a single endpoint for saving JSON comments.

melech-plan-review