The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of python3 .plan/execute-script.py to invoke local scripts for file management, logging, and plan documentation. This is an expected architectural pattern for the Plan Marshall platform.
[DATA_EXFILTRATION]: All data processing, including reading marketplace components and writing inventory results, is confined to the local .plan/ directory. No network operations targeting external domains were identified.
[PROMPT_INJECTION]: The skill provides structured instructions for plugin development tasks and does not contain any attempts to bypass safety filters or override model constraints.
[PROMPT_INJECTION]: The skill implements a workflow for analyzing external marketplace files, which constitutes a surface for indirect prompt injection.
Ingestion points: workflow/component-analysis.md reads untrusted component files from the marketplace for semantic evaluation.
Boundary markers: The analysis is tightly constrained by a predefined framework that requires the agent to output only a structured TOON summary, minimizing the chance of executing instructions within the analyzed data.
Capability inventory: The agent can execute local management scripts and perform file writes within the plan's working directory using the system's provided tools.
Sanitization: The classification logic relies on the evidence-based extraction of format indicators (e.g., regex patterns for JSON/TOON) and a fixed decision matrix, focusing the LLM on data extraction rather than instructional obedience.

ext-outline-workflow