The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it reads and executes implementation plans from external Markdown files.
Ingestion points: Implementation plans are loaded and read during 'Step 1: Load and Review Plan' (SKILL.md).
Boundary markers: No explicit structural boundary markers are used to isolate plan content; the skill relies on instructional 'critical review' steps.
Capability inventory: The skill can create tasks, modify codebase files, run verification commands, and invoke downstream skills for git management and PR creation.
Sanitization: Mitigation depends on the LLM's adherence to the 'blocker taxonomy' which explicitly lists safety-critical ambiguity as a reason to stop and report.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary tasks and verifications defined within the implementation plans. While this is necessary for its function as a development agent, it provides a vector for executing malicious commands if an injected plan is followed without sufficient oversight.
[SAFE]: The skill implements proactive security checks by defining specific 'Blockers' that mandate stopping execution if credentials are found to be broken or if destructive actions occur that were not authorized by the plan.

executing-plans