The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted markdown files and interpolates them into prompts for external AI agents.
Ingestion points: The plan file content is read and embedded in the prompt within panel-plan.sh at lines 151-153.
Boundary markers: The content is wrapped in a fenced code block and each line is prefixed with line numbers (via nl -ba), which may help sub-agents distinguish plan data from system instructions.
Capability inventory: Sub-agents (codex, claude, opencode) are explicitly granted read access to the entire repository via Read, Glob, and Grep tools to verify plan assumptions.
Sanitization: The skill does not perform explicit sanitization or escaping on the plan file's content before interpolation into the sub-agent prompts.
[COMMAND_EXECUTION]: The script panel-plan.sh executes several local binaries (codex, claude, opencode, timeout, nl) using shell subprocesses. This is the primary mechanism of the skill and utilizes restrictive flags such as --sandbox read-only and --permission-mode plan to limit the scope of the sub-agents.

panel-plan