The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources which can influence agent behavior and lead to unauthorized actions.
Ingestion points: Reads implementation units from plan files (e.g., docs/plans/*.md), PR feedback files, and project-specific AGENTS.md files that may override artifact locations.
Boundary markers: The instructions rely on markdown structures like Change:, Files:, and Verify: to parse data, but they lack explicit security boundaries or instructions to ignore embedded adversarial prompts.
Capability inventory: The agent is authorized to modify files on the local filesystem and execute arbitrary shell commands specified in the Verify: section of the ingested plan.
Sanitization: There is no evidence of sanitization, validation, or integrity checking of the content or commands within the plan or feedback files before they are acted upon.

do-work