The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external plan files to drive its behavior, making it vulnerable to malicious instructions embedded in those files.
Ingestion points: The skill reads a plan file from a provided file path and extracts phase instructions, file lists, and success criteria (SKILL.md, Step 1).
Boundary markers: There are no explicit boundary markers or instructions to treat the plan content as untrusted data; the agent is instructed to "follow the plan's instructions precisely."
Capability inventory: The skill possesses the ability to create/edit files (Step 3) and execute arbitrary shell commands listed in the plan (Step 4).
Sanitization: No sanitization or validation of the plan file's contents is mentioned before execution.
[COMMAND_EXECUTION]: The skill automatically executes "Automated Verification" commands found within the plan file (SKILL.md, Step 4). While these are intended for testing, they allow for arbitrary shell command execution if the plan file is compromised.
[DYNAMIC_EXECUTION]: The agent is instructed to interpret and execute "Automated QA" scenarios, which may involve using advanced tools like browser-use based on logic defined in the external plan file (SKILL.md, Step 4).

phase-running