The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes potentially untrusted data from local project files. \n
Ingestion points: The skill reads content from local files including implementation_plan.md, PLAN.md, and task.md using the std:fs.read@v1 operation. \n
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore embedded commands within the plan content before it is restructured. \n
Capability inventory: The skill uses std:fs.write@v1 to modify files on the local filesystem, which is part of its core functionality for restructuring plans. \n
Sanitization: No evidence was found of input validation or sanitization of the file content before it is passed to the AI for processing.

plan-phases