The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes content from various external files to generate planning proposals.
Ingestion points: Reads project data from multiple directories including product/**, user-stories/**, discovery/**, and tasks/*.md.
Boundary markers: The instructions do not define clear delimiters or specific warnings to ignore instructions embedded within the source project files.
Capability inventory: The skill's capabilities are limited to generating a dry-run proposal table. It does not have permissions for file writes, network operations, or shell command execution.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the project files.
[DATA_EXFILTRATION]: The skill accesses potentially sensitive team information by reading member-specific documents.
Evidence: It explicitly reads <knowledge_dir>/members/<member-id>.md to determine project fit, responsibilities, and availability when proposing task owners.

delivery-planning