The Agent Skills Directory

[PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by automatically ingesting untrusted local file content into the agent's prompt context during normal operation.
Ingestion points: The PreToolUse hook defined in SKILL.md executes cat task_plan.md, which reads the first 30 lines of the task plan file directly into the agent's context window before every tool execution.
Boundary markers: Absent. The content of the planning file is injected into the context without delimiters or instructions for the agent to treat the content as potentially untrusted data.
Capability inventory: The skill allows the agent to use powerful tools such as Bash, WebFetch, Write, and Edit.
Sanitization: There is no validation or sanitization of the content of task_plan.md before it is presented to the agent.
[COMMAND_EXECUTION]: The skill relies on local shell scripts and hook-based command execution to facilitate its state-management features.
Evidence: The Stop hook in SKILL.md executes scripts/check-complete.sh to verify if all task phases are marked as complete.
Evidence: The scripts/init-session.sh script uses Bash heredocs to create the initial task_plan.md, findings.md, and progress.md files in the user's project directory.
Evidence: The PreToolUse and PostToolUse hooks utilize standard shell commands (cat, echo, head) to display current progress and remind the agent to update the plan.

planning-with-files