The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from user plan archives and Claude Code logs to generate "actionable prompt instructions." These instructions are then intended to be injected back into the agent's context in future sessions.
Ingestion points: The skill reads *-denied.md files from ~/.plannotator/plans/ and session logs from ~/.claude/projects/.
Boundary markers: There are no explicit boundary markers or instructions to the model to ignore potentially malicious content embedded within the feedback or annotations it is processing.
Capability inventory: The skill utilizes sub-agents for parallel processing and writes a persistent hook file to the filesystem.
Sanitization: The skill lacks sanitization for the extracted text; it explicitly instructions extraction agents to capture "actual words used" and "notable phrases," which could include malicious payloads designed to influence future prompt behavior.
[PERSISTENCE]: Phase 6 of the skill implements an "improvement hook" by writing instructions to ${PLANNOTATOR_DATA_DIR:-~/.plannotator}/hooks/compound/enterplanmode-improve-hook.txt. This file is designed for automatic injection into all future planning sessions, creating a persistence mechanism for the skill's generated output. While the skill asks for user confirmation, this remains a significant persistence vector.
[COMMAND_EXECUTION]: The skill uses local shell commands (ls, stat) to version reports and executes a bundled Python script (scripts/extract_exit_plan_mode_outcomes.py) to process Claude Code transcripts. These commands are executed locally to manage the skill's state and data sources.

plannotator-compound