The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from user arguments and the local repository, which is then used to construct prompts for subsequent AI reasoning rounds without sanitization.
Ingestion points: User-provided task descriptions via $ARGUMENTS and codebase content accessed via Read tools.
Boundary markers: The skill lacks explicit delimiters or instructions within the generated markdown files (task.md, ledger.md) to prevent the agent from obeying instructions embedded in the ingested data.
Capability inventory: The skill utilizes Bash for orchestration, Write for file management, and Read for repository inspection.
Sanitization: While the session slug is sanitized for shell safety, the actual content of the implementation plans and the task brief is not sanitized for prompt-based attacks.
[COMMAND_EXECUTION]: The skill uses the Bash tool to orchestrate session state and invoke a local helper script.
Execution pattern: It dynamically constructs shell commands to create temporary directories and run the pair-codex script located in the plugin's script directory.
Sanitization: The skill employs a character filter (tr -cs 'A-Za-z0-9' '-') on user-provided arguments when creating the session slug, which serves as a mitigation against shell command injection in that specific context.

pair-planning