The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external markdown plan files, which serves as a vector for indirect prompt injection.
Ingestion points: External markdown files (e.g., plan.md) are parsed in Step 2 to extract task metadata and instructions.
Boundary markers: The skill does not specify the use of clear delimiters or instructions for sub-agents to ignore potentially malicious commands embedded within the task descriptions.
Capability inventory: Sub-agents launched by this skill are granted powerful tools, including Bash, Write, and Edit access.
Sanitization: Although the shell execution method is technically secure, the semantic content passed to sub-agents is not sanitized, creating a risk that a malicious plan could hijack sub-agent behavior.
[DYNAMIC_EXECUTION]: The skill dynamically constructs and executes shell commands to facilitate parallel processing.
Execution method: In Step 3, the orchestrator assembles a bash command to launch the claude CLI in print mode as a background process.
Risk factor: The command construction uses task identifiers (TASK_ID) derived from external plans to create log files (e.g., /tmp/co-design-[TASK_ID]-output.log). If these identifiers are not strictly validated by the executing agent, they could potentially be used for path traversal or command injection.
Mitigation note: The skill correctly uses quoted heredocs (<<'PROMPT_EOF') to prevent the parent shell from interpreting variables within the prompt content, which is a significant security best practice.

co-design