The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow in SKILL.md defines shell command execution patterns that directly interpolate user-controlled variables into a command line string. In Step 4, the agent is directed to execute python3 <skill_dir>/scripts/scaffold_goal.py --root . --slug <slug> --title "<goal title>" --objective "<one sentence outcome>". If the user-supplied values for these placeholders contain shell metacharacters (e.g., semicolons, backticks, or pipe symbols), a malicious user could achieve arbitrary command execution on the host system, depending on how the agent platform handles placeholder replacement.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data to generate high-privilege instructions for a downstream agent ("Codex").
Ingestion points: As noted in SKILL.md, the agent gathers a goal name, objective, and context directly from the user to populate the goal package.
Boundary markers: The generated goal-prompt.md file and the final prompt instructions in SKILL.md do not utilize clear delimiters or system instructions to distinguish user-provided content from the agent's core instructions. This allows instructions embedded within a user's objective to potentially manipulate the downstream agent's behavior.
Capability inventory: The skill possesses the capability to write multiple files to the local file system using scripts/scaffold_goal.py and to invoke external tools like plannotator via the shell.
Sanitization: The scripts/scaffold_goal.py script lacks sanitization logic for the --title and --objective inputs before they are written into markdown files, ensuring that any malicious payloads provided by a user are persisted into the project's durable planning documents.

plannotator-setup-goal