The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external specifications, plans, or PRDs to generate implementation tasks. This creates a vulnerability surface where malicious content within the source data could influence the agent's behavior or the generated tasks.
Ingestion points: External specifications or requirements provided as input for task generation in SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the input data.
Capability inventory: The skill writes to the filesystem (creating files in the /tasks/ directory) and generates shell commands (git checkout, npx jest) for implementation.
Sanitization: There is no explicit sanitization or validation logic to filter malicious instructions within the ingested specifications.
[COMMAND_EXECUTION]: The skill is designed to generate shell commands for branch creation (git checkout -b) and testing (npx jest). Because the branch name is derived from the specification title (feature-name), a maliciously crafted specification title could lead to command injection if the agent executes the generated instructions without further validation.

task-planner