The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes instructions to analyze and synthesize data from external, untrusted sources such as Discord threads and external repositories (references/full-workflow.md). While the persona is instructed to treat these as 'claims' rather than instructions, the ingestion of arbitrary external text into the planning context creates a surface for indirect injection.
Ingestion points: Ingests context from external documentation, Discord discussions, and third-party repositories as described in references/full-workflow.md and references/intent-unclear.md.
Boundary markers: Employs structured prompts for sub-agents using TASK / DELIVERABLE / SCOPE / VERIFY and mandates explicit internal verification of all external claims.
Capability inventory: The skill can spawn sub-agents for exploration and research and executes a local script (scaffold-plan.mjs) to write artifacts under the .omo/ directory.
Sanitization: Instructions require the agent to cite evidence for every codebase claim and reject findings that rely solely on external text or misleading command outputs.
[COMMAND_EXECUTION]: The skill executes a local Node.js utility script, scripts/scaffold-plan.mjs, to create plan skeletons and drafts.
Evidence: The script is invoked via node "<skill-root>/scripts/scaffold-plan.mjs" with various operational flags.
Security Controls: The script contains comprehensive security checks, including resolveSafeOmoPath and assertSafeWriteParent, which restrict all file writes to the .omo/ directory, enforce .md file extensions, and explicitly prevent path traversal or symlink-based escapes from the workspace root.

ulw-plan