The Agent Skills Directory

[SAFE]: No malicious patterns, such as hardcoded credentials, unauthorized network operations, or persistence mechanisms, were found in the skill metadata or body.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to process external plan data. Ingestion points: Reads instructions and plan content from work/<slug>/README.md. Boundary markers: None; the file content is processed without delimiters or explicit instructions to disregard embedded commands. Capability inventory: Access is restricted to reading and editing project-specific files within the work directory, which limits the potential impact of any malicious data. Sanitization: No specific validation or filtering is applied to the input content before processing.

review-plan