The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted *.plan.md files as implementation plans, which creates an attack surface for indirect prompt injection where a malicious plan could attempt to hijack the agent.
Ingestion points: The skill reads file paths provided via arguments and processes their content in the Plan Handoff and Step 1 sections of SKILL.md.
Boundary markers: The instructions include strong defensive boundaries, explicitly telling the agent to treat plan content as 'data, not instructions' and to ignore phrases like 'ignore previous rules' or 'skip validation'.
Capability inventory: The skill executes shell commands for environment detection, test runners (npm, bun, etc.), coverage tools, and git checkpoints. It also executes a local setup script scripts/setup-package-manager.js.
Sanitization: The skill mandates that any commands embedded in plans must be sanitized, matched against allowed project actions, and approved by the user before execution.
[COMMAND_EXECUTION]: The skill performs environment discovery and executes build/test tools via the shell.
Evidence: Executing node scripts/setup-package-manager.js --detect to resolve the local environment.
Evidence: Executing various test runner commands (npm test, bun test, pnpm test) and git commands for checkpoints as described in the Step 0 and Git Checkpoints sections.

tdd-workflow