The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from multiple sources to inform the work plan. This creates a surface for indirect prompt injection where malicious instructions embedded in project records or web pages could manipulate the agent's planning logic.
Ingestion points: Reads meeting records (meetings/*.md), site reports (site-reports/*.md), and retrieves content from external URLs via WebFetch and WebSearch.
Boundary markers: Absent. The skill does not define explicit delimiters or instructions to ignore embedded commands within the processed materials.
Capability inventory: The agent has Bash execution, filesystem Write access, and network capabilities (WebFetch), which could be leveraged if an injection is successful.
Sanitization: The skill includes checks for 'malformed' decision records but lacks a general sanitization layer for natural language inputs derived from external sources.
[COMMAND_EXECUTION]: The skill uses the Bash tool to resolve project roots and inspect repository evidence. While these are legitimate functions for a developer-oriented skill, the execution of shell commands based on repository state provides a high-privilege capability that warrants caution if combined with untrusted project data.
[EXTERNAL_DOWNLOADS]: The skill utilizes WebFetch and WebSearch to gather information on regulations, standards, and software behavior. While used for research, these tools allow the agent to fetch content from arbitrary internet endpoints, which is a key component in data exfiltration or remote instruction retrieval chains.

workplan