The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted plan data which creates a surface for indirect prompt injection attacks against the subagents.
Ingestion points: In Step 1, the skill incorporates user-provided plan text or content from file paths directly into the analysis brief.
Boundary markers: The skill mitigates risks by imposing a "Read-only contract" in Step 2, explicitly instructing subagents not to create, edit, or delete files or run state-changing commands. It also uses a "Grounding rule" to restrict analysis to specific cited lines.
Capability inventory: Subagents are granted file-reading access for context, while the primary agent can perform file writes to the plan artifact.
Sanitization: The instructions do not specify any sanitization or escaping for the plan text before passing it to subagents.
[COMMAND_EXECUTION]: The skill can perform file system modifications to apply mitigations identified during the analysis.
Evidence: Step 4 details a process for editing plan files or restating amended plans.
Mitigation: The skill enforces user oversight via AskUserQuestion before any edits are landed and explicitly forbids auto-application in headless environments.

premortem