The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting data from the codebase, documentation, and issue trackers to answer questions and inform plans. This content is potentially untrusted and could contain instructions designed to manipulate the agent's behavior during planning or code execution.
Ingestion points: Codebase files, documentation, issue trackers, and session logs.
Boundary markers: The skill uses a structured 'Question Log' and 'Settled Decisions' to track state, but does not explicitly mention sanitizing input from repository files.
Capability inventory: File system write access (for plans, ADRs, and context files), repository inspection, and the ability to run code prototypes.
Sanitization: No specific sanitization or filtering of external content from files is described before it is used to influence agent decisions or code probes.
[DYNAMIC_EXECUTION]: The instructions direct the agent to 'run the cheapest isolated probe or prototype' when factual questions cannot be settled by reading documentation alone. This involves runtime script generation and execution based on gathered context.
[COMMAND_EXECUTION]: The agent is authorized to perform environment exploration, including inspecting the issue tracker and codebase, and running background explorations where the platform harness permits.
[DATA_EXPOSURE]: The skill is designed to read and process potentially sensitive project data, including the full codebase and issue history, to generate its summaries and plans.

grill-to-plan