The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local state-management script (update-phase.sh) located within the plugin's internal directory. This is used to transition project phases and is a legitimate use of the tool within the agent's operating environment.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in its Stakeholder Review workflow (Step 9). It reads and interpolates untrusted data from the project directory into prompts for parallel sub-agents (Tasks).
Ingestion points: Reads consulting-project.json, deliver/*.md, define/problem-statement.md, and personas/*.json from the project directory.
Boundary markers: The prompt template provided to the persona Tasks does not use explicit boundary markers or XML-style delimiters to separate instructions from the project data being evaluated.
Capability inventory: While the primary skill has broad permissions including Bash and Write, the persona Task sub-agents are explicitly configured with a "Read tool only" restriction, which significantly mitigates the risk of a successful injection leading to system-level impact.
Sanitization: No explicit sanitization or escaping of the ingested markdown or JSON content is performed before interpolation into the sub-agent prompts.

consulting-deliver