The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data stored in the repository's docs/plans/ directory. If an adversary can modify these files (e.g., via a Pull Request), they could inject instructions into the 'Notes' or 'Question' sections of a map or ticket. The instructions explicitly state that 'An effort can override this in its Notes, carrying execution into the map itself', which creates a surface where external file content directly overrides the agent's default behavior.
Ingestion points: docs/plans/<effort>/map.md and docs/plans/<effort>/tickets/*.md are read into the agent session.
Boundary markers: The skill does not employ specific delimiters or instruction-guarding techniques to differentiate between system instructions and the content of the ticket files.
Capability inventory: The skill allows for reading, creating, and modifying files within the repository's documentation folders.
Sanitization: No sanitization or validation logic is defined for processing the markdown content before the agent interprets it.

wayfinder