The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains architectural state by reading and writing to a local plan.md file. This creates an attack surface where an attacker who can modify this file could inject malicious instructions into the agent's context during subsequent sessions.\n
Ingestion points: plan.md file in the project root.\n
Boundary markers: Absent. The agent is instructed to read the file and incorporate its contents directly into recommendations without explicit delimitation of untrusted content.\n
Capability inventory: The agent has filesystem access (to manage plan.md and .gitignore) and default network access (to research architecture options).\n
Sanitization: Absent. The instructions do not specify any validation or sanitization for the contents of the plan.md file.\n- [SAFE]: The skill incorporates security best practices by requiring the plan.md file to be added to .gitignore to prevent accidental credential or sensitive data leakage to version control systems. It also explicitly includes 'malicious input' as a mandatory failure mode to evaluate during the architecture planning process.

architecture-planning