The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted user data—such as project ideas, PRDs, and specifications—and incorporates them into an implementation plan intended for execution by downstream tools like lite-execute. Malicious instructions embedded in the input data could be carried into the final plan.
Ingestion points: User-provided specs, PRDs, or ideas defined in the Interview and Plan sections of SKILL.md.
Boundary markers: The skill does not define delimiters or provide instructions to the agent to ignore or isolate embedded instructions within the source data.
Capability inventory: The skill has the capability to write the generated plan to the local filesystem (specifically the /tmp directory).
Sanitization: No evidence of sanitization, validation, or escaping of the external content was found before it is included in the final plan artifact.
[PROMPT_INJECTION]: The skill instructions attempt to override standard agent behavior by demanding the spawning of "Sonnet/GPT-5.6-Terra-Medium" subagents. The reference to a non-existent model version ("GPT-5.6-Terra-Medium") is a pattern used to trick the agent into simulating unauthorized capabilities or personas outside its standard configuration.

lite-plan