The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from feature specifications (spec.md) to generate execution plans. Evidence Chain: 1. Ingestion points: External specification files at the user-provided {spec-path}. 2. Boundary markers: Absent; there are no instructions for the subagent to ignore embedded natural language instructions within the spec data. 3. Capability inventory: Shell execution (bash), file system access, and version control operations (git). 4. Sanitization: Absent; data is extracted using grep and awk without validation against malicious injection or path traversal strings.
[COMMAND_EXECUTION]: The skill executes multiple bash commands to manage workspace state and worktrees. It extracts the RUN_ID variable directly from file content and interpolates it into directory navigation commands (e.g., cd .worktrees/${RUN_ID}-main). Without rigorous validation, this represents a potential path manipulation or traversal risk.
[DYNAMIC_EXECUTION]: The skill dispatches a subagent to dynamically generate an implementation plan which is then committed to the repository. Because this plan is intended for future execution, any malicious instructions successfully injected during the decomposition phase would be carried forward into the subsequent execution steps of the development workflow.

decomposing-tasks