The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted specification files, which creates a potential surface for indirect prompt injection.
Ingestion points: The skill reads specification files (artifact: spec) and supporting design artifacts as described in SKILL.md (Workflow Step 1) and the plan-template.md structure.
Boundary markers: The skill requires inputs to have specific metadata (status: validated) and uses SHA-256 hash verification to detect unauthorized changes to source specifications or supporting files.
Capability inventory: The skill is strictly limited to read-only repository inspection and writing a markdown planning artifact (plan.md). It explicitly forbids modifying code, tests, or configurations, and prohibits Git operations like commit or push.
Sanitization: While it does not perform traditional input sanitization, it enforces a rigid workflow that requires explicit verification of all requirements against repository evidence and established design constraints.
[COMMAND_EXECUTION]: The skill instructions include specific safeguards to prevent the agent from executing commands during the planning process. It distinguishes between commands that are being planned for future execution by a human or another agent and the read-only inspection tasks required to create the plan.

implementation-plan