The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data in the form of Trellis planning artifacts (Markdown and JSON files). This represents a surface for indirect prompt injection, where malicious instructions could be embedded in the task documentation.
Ingestion points: The skill reads prd.md, design.md, implement.md, task.json, and manifest files (*.jsonl) from the task directory provided in arguments.
Boundary markers: The skill does not employ explicit delimiters or instructions to the LLM to ignore potential instructions embedded within the ingested artifact content.
Capability inventory: The skill utilizes Read, Write, and Bash tools. It specifically executes Python scripts that perform shell calls to git for repository inspection.
Sanitization: The skill's precheck script uses regex-based identifier extraction and standard JSON parsing, which provides structure but does not sanitize text content against LLM-targeted injection patterns.
[COMMAND_EXECUTION]: The skill executes shell commands via subprocess calls within its included Python scripts (scripts/plan_precheck.py and scripts/write_review_report.py).
Evidence: The scripts invoke git ls-files, git check-ignore, and git show to verify citations and repository state.
Safety Measures: The scripts avoid shell=True and validate input parameters. Task names used in path construction are validated against a strict alphanumeric regex (TASK_NAME_RE), and the scripts explicitly check for and refuse to follow symlinks or reparse points to prevent path traversal attacks.

trellis-plan-review