The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external task plans and codebase content, creating a surface for indirect prompt injection where malicious instructions could be embedded in the data being analyzed.
Ingestion points: The skill reads task definitions from docs/<KEY>-tasks.md and inspects the project codebase across all four subagent stages.
Boundary markers: The instructions include explicit defensive prompts to treat task plans, snapshots, code, and command output strictly as data and never as instructions that can override the skill's scope.
Capability inventory: The skill is restricted to reading local project files and writing four specific Markdown artifacts within the docs/ directory. It is explicitly forbidden from calling GitHub/Jira APIs, executing arbitrary shell commands, or performing network exfiltration of ingested data.
Sanitization: The skill relies on prompt-level constraints and structured artifact templates to ensure that processed content does not influence the agent's control flow or expand its mutation scope.
[EXTERNAL_DOWNLOADS]: The skill fetches methodology guidance from established industry sources and official documentation to inform its planning recommendations.
Evidence: The references/external-sources.md file defines a whitelist of external URLs, including official GitHub and Atlassian documentation, as well as respected technical resources from Martin Fowler, Sandi Metz, and Cucumber.io.
Context: These fetches are limited to two pages per stage and are used solely for conceptual methodology (e.g., Given/When/Then framing or YAGNI principles) rather than executing remote code or performing tracker transport.

planning-task-execution