The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes plan documents to drive agent behavior and sub-agent tasks.
Ingestion points: Reads plan files from paths specified in $ARGUMENTS or located via file search in docs/plans/ (SKILL.md).
Boundary markers: Absent; plan content (step descriptions, actions, and verification criteria) is directly interpolated into task objects and sub-agent prompts without delimiters.
Capability inventory: Includes shell command execution (verification), file system writes, and the ability to trigger sub-agents like web-researcher and code-reviewer with context from the plan.
Sanitization: No evidence of sanitization or validation of the content extracted from the plan files before it is used to influence the agent's next actions.
[COMMAND_EXECUTION]: Executes shell commands for environmental checks and task verification.
Evidence: Uses the Bash tool to execute test -f .git to determine if it is operating within a git worktree. Additionally, it executes arbitrary "verification criteria" defined in the plan document during the implementation steps.

implementing-plans