The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input, which is interpolated into prompts for planning and critique subagents.
Ingestion points: The user's idea and notes_short are used directly in the Plan, Critique, and Revise prompts defined in references/prompts.md.
Boundary markers: Absent; untrusted user content is not wrapped in specific delimiters or safety instructions.
Capability inventory: The skill has permissions to write artifacts to the .megaplan/ directory (SKILL.md), perform git commits (SKILL.md), and execute verification commands during the review phase (references/prompts.md).
Sanitization: Absent; the skill does not implement explicit escaping or filtering of user-provided strings before interpolation.
Mitigation: The risk is mitigated by the skill's multi-stage validation process, which involves three parallel critics, a gatekeeper with a dedicated security scoring lens, and a final reviewer.
[COMMAND_EXECUTION]: The workflow involves running shell commands for version control and repository management.
Evidence: The orchestrator is instructed to perform atomic commits and repository inspections as part of the implementation and execution loops in SKILL.md and references/prompts.md.
[DYNAMIC_EXECUTION]: The skill dynamically executes verification checks to validate implementation results.
Evidence: The pre-commit review process in references/prompts.md requires the agent to run the smallest relevant verification checks to ensure the implementation aligns with the plan and is safe to commit.

megaplan