The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources which could contain malicious instructions designed to influence the agent's planning or execution.
Ingestion points: The skill reads content from project files including tasks.md, proposal.md, specs, openspec/project.md, and CLAUDE.md. It also accepts user input via $ARGUMENTS in the replan and pivot commands.
Boundary markers: The skill lacks explicit boundary markers or XML-style tagging when interpolating content from these files into its analysis or proposal generation workflows.
Capability inventory: The skill has access to powerful tools including Bash, Edit, and Write, which could be abused if an injection in a project file successfully subverts the agent's goals.
Sanitization: There is no evidence of sanitization or filtering of the content read from external files before it is used to determine the next steps of the project plan.

openspec-replan