The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) during the task analysis phase.
Ingestion points: User-provided task descriptions are accepted via the task.content parameter in the decompose and _ai_decompose methods within SKILL.md.
Boundary markers: The AI prompt used for decomposition (_ai_decompose) lacks delimiters (such as triple backticks or XML tags) or system instructions to ignore potential commands embedded within the task description.
Capability inventory: The skill has the authority to invoke model-router and task-registry and performs write operations to PersistentStorage. Maliciously crafted task descriptions could potentially hijack the execution flow or poison the stored execution plans.
Sanitization: The implementation does not include any validation, escaping, or sanitization logic for the task.content before it is used in regex matching or AI prompt generation.

decomposition-planner