The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and obey instructions from an external file (.goal.md) and referenced handoff documents (e.g., in docs/plans/), which serves as a significant attack surface.
Ingestion points: The agent reads .goal.md from the repository root and follows paths to handoff documents at the start of every session.
Boundary markers: There are no specific delimiters or instructions to treat the content of .goal.md as untrusted data; conversely, the skill explicitly instructs the agent that "Standing constraints... inside .goal.md bind every session and outrank this skill's defaults."
Capability inventory: The skill authorizes the agent to perform file writes, commit code, open Pull Requests, and "run the real gates" (execution of tests or build scripts).
Sanitization: No sanitization or validation of the input from these files is performed. An attacker who can influence the contents of .goal.md (e.g., via a malicious Pull Request) could redirect the agent's behavior by injecting "Standing constraints" or "Decisions."
[COMMAND_EXECUTION]: The "Work loop" logic encourages autonomous execution of tasks with reduced human-in-the-loop intervention.
The skill instructs the agent to "ENTER THE WORK LOOP... before starting unrelated work" and mandates that transient failures "are NEVER stop conditions," requiring the agent to retry or route around errors automatically.
This autonomy increases the risk that an injected or misunderstood goal could result in a large volume of unauthorized file modifications or Git operations before the user can intervene.

goal