The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes external, potentially untrusted input to generate executable instructions.
Ingestion points: The skill reads the Goal section from work/<slug>/README.md and background context from project.md (SKILL.md).
Boundary markers: The instructions do not define any delimiters or explicit system instructions to ignore embedded prompts within the content retrieved from the README or project files.
Capability inventory: The skill is configured with Read, Edit, and Write access to the work/** directory, and the ability to invoke the asta-assistant:review-plan skill (SKILL.md frontmatter).
Sanitization: There is no evidence of sanitization, validation, or escaping of the input data before it is interpolated into the generated # Instructions section of the README file.

plan-work