The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by design. It actively encourages the agent to ingest and verbatim copy external data (Sources) such as URLs, Figma links, PRD paths, and tickets into the plan.md file. These sources are later read and followed during the task execution phase. An adversary could embed malicious instructions in these external documents that the agent might inadvertently execute while attempting to 'implement the step' or 'honor Constraints.'
Ingestion points: creating-task.md (§3. Gather project context), creating-multiple-tasks.md (§3. Carry Sources), and task-planner.md (Planning workflow).
Boundary markers: The skill uses a structured Requirements section in the plan.md template, but it does not specify explicit escaping or 'ignore embedded instructions' delimiters for the external content.
Capability inventory: The skill and its sub-agents (task-implementer) have full file system access (read/write), the ability to execute Git commands, and the capability to load and follow instructions from other skills discovered in the project.
Sanitization: The instructions explicitly state to 'Prefer verbatim Sources over paraphrase,' which increases the likelihood of malicious control sequences persisting in the agent's context.
[COMMAND_EXECUTION]: The skill defines sub-agents (task-implementer, task-planner) that are instructed to execute shell-based Git commands (git status, git diff, git add, git commit) to manage the repository state. While these commands are constrained to task lifecycle management and repository tracking, they represent a significant capability that could be abused if the agent's context is successfully manipulated via the aforementioned indirect injection surface.

managing-tasks