The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external plan files which serve as the primary source of instructions for subagents. This creates a surface for indirect prompt injection.
Ingestion points: The orchestrator reads a markdown plan file (e.g., plan.md) in Step 2 and extracts task descriptions, acceptance criteria, and validation steps.
Boundary markers: While the subagent prompt template uses structural headers like ## Context and ## Your Task, it lacks specific instructions to disregard or sanitize potentially malicious directives embedded within the plan content.
Capability inventory: Launched subagents possess significant capabilities, including reading/writing files in the codebase, executing shell commands for tests and validation, and performing git commit operations.
Sanitization: The skill does not perform any validation or sanitization on the content retrieved from the plan file before passing it to subagents or executing commands.
[COMMAND_EXECUTION]: The orchestration logic specifically directs subagents to execute "exact new/updated test command(s)" or "agreed alternative verification" (such as manual_check, static_check, or runtime_check) defined within the plan file. This allows for the execution of arbitrary shell commands if the plan file is maliciously crafted.
[DYNAMIC_EXECUTION]: In Step 4, subagents are instructed to run validation steps which may involve executing shell commands or scripts. If the plan file provides a path to a script or a complex command string, the agent will execute it dynamically to verify task completion, representing a dynamic execution pattern based on external data.

super-swarm