The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted content from plan files (.md) and prior context files (lessons.md) to define task decomposition and sub-agent instructions. Maliciously crafted instructions within these files could influence the orchestrator or sub-agents to perform unintended actions.
Ingestion points: Phase 0.1 resolves plan files from docs/plans/ or user arguments; Phase 0.2 loads context from .agent-team/*/lessons.md; Phase 4 processes teammate messages.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded prompts within the ingested data, relying instead on conceptual structured message prefixes.
Capability inventory: The orchestrator has access to Bash for shell execution and TaskCreate for spawning sub-agents with full tool access.
Sanitization: No explicit sanitization of ingested plan or context content is performed before use in agent prompts.
[COMMAND_EXECUTION]: The skill executes local project scripts and shell commands to initialize the workspace and manage task coordination.
Evidence: The skill runs scripts/setup-worktree.sh during teammate spawn and uses hooks such as detect-resume.sh, compute-critical-path.sh, and check-integration-point.sh. The Execute Reviewer agent is instructed to run project build and test commands via Bash.

execute