The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it ingests untrusted external data which then influences the agent's actions and tool usage.
Ingestion points: The skill loads implementation plans (markdown) and processes results from delegated tasks via Skill(conjure:delegation-core) and subagents as described in SKILL.md and modules/subagent-fallback.md.
Boundary markers: There are no explicit instructions to use delimiters or "ignore embedded instructions" warnings when the agent reads or processes the implementation plan or delegated code.
Capability inventory: The skill performs file system writes (.attune/execution-state.json, docs/lessons-learned.md) and executes shell commands such as pytest, make, uv, and git.
Sanitization: There is no mention of sanitizing, escaping, or validating the content of implementation plans or delegated task outputs before they are used to drive the implementation cycle or executed as tests.

project-execution