The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution syntax (!command) in SKILL.md to run plannotator annotate $ARGUMENTS immediately when the skill is loaded. By directly interpolating the $ARGUMENTS placeholder into the shell command, the skill is vulnerable to command injection. An attacker or malicious input could include shell metacharacters (e.g., ;, |, &) to execute arbitrary commands on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by processing external content without proper isolation.
Ingestion points: The output of the plannotator command is loaded directly into the agent's prompt context in SKILL.md.
Boundary markers: There are no delimiters (e.g., XML tags or block quotes) or instructions to the agent to disregard embedded commands within the tool output.
Capability inventory: The agent is explicitly instructed to "Address the feedback" and perform work based on the annotations, giving the external content direct control over the agent's subsequent actions.
Sanitization: No sanitization or validation is performed on the output returned by the external tool before it is processed by the agent.
[COMMAND_EXECUTION]: The skill's primary function is to execute the plannotator CLI tool. While this matches the stated description, the lack of input validation on the arguments passed to this command creates a security risk.

plannotator-annotate