The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to refresh status evidence using commands like git status and git log -1. These are standard development operations used to retrieve local metadata and do not represent a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from local project files (e.g., PLAN.md, .sdlc/) and user request history to build its report. While this creates a surface for indirect prompt injection, the risk is minimal as the skill only extracts text for reporting purposes rather than using it to drive sensitive tool executions.
Ingestion points: Reads deliverable items from PLAN.md, .sdlc/ files, kanban cards, and session transcripts.
Boundary markers: No explicit delimiters are mandated for the external content gathered during the 'ledger' building phase.
Capability inventory: The skill is primarily informational and does not involve network exfiltration or direct execution of the data it reads.
Sanitization: There are no instructions for sanitizing or escaping the data read from external project files before presenting it in the final report.

work-status