The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled product specification files (spec-product*.md) through multiple parallel subagents. This creates a surface where malicious instructions embedded in a product plan could influence the agent's analysis, bias the critique outcomes, or manipulate the resolution process.
Ingestion points: The contents of spec-product*.md are read and processed in the critique:30 and critique:50 steps.
Boundary markers: There are no explicit delimiters or "ignore embedded instructions" warnings used when providing the plan content to the LLM subagents.
Capability inventory: The skill has the ability to write to the file system (updating the plan), invoke subagents, and interact with the user via the ask_user_question tool.
Sanitization: The skill does not mention any sanitization, validation, or escaping of the input specification content before it is processed by the subagents.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to resolve project state, parse configurations, and manage files.
Evidence: The skill uses node -e within shell commands in SKILL.md to parse JSON data from the stelow.json configuration file.
Evidence: It sources a utility script (read-config.sh) from a relative path belonging to a related skill (stelow-workflow-orchestrator), assuming a specific directory structure.
Evidence: Standard utilities like grep, ls, and mkdir are used to extract metadata from plan files and organize the critique output directory.

stelow-workflow-plan-critique