The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes local configuration files and environment metadata to generate build plans. While malicious configuration files could theoretically influence recommendations, the script uses deterministic logic and strict argument parsing. This is an inherent part of the skill's functionality and does not present an active threat.
Ingestion points: The scripts/plan.mjs script reads local configuration files via the readConfig function from paths provided in arguments.
Boundary markers: The script returns a structured JSON schema to the agent rather than raw natural language prompts, reducing the risk of accidental obedience to embedded instructions.
Capability inventory: The script performs local file reads and metadata analysis. It does not perform network operations, file writes, or dynamic code execution.
Sanitization: Input arguments are validated using node:util.parseArgs and specific type checks for task categories and modes.
[COMMAND_EXECUTION]: The skill documentation references the use of terminal tools and Bash for system checks. The planning script itself does not execute arbitrary shell commands, and the instructions explicitly state that terminal access is scoped to the workspace and does not provide filesystem isolation. The script uses Node.js modules for logic rather than spawning external processes for its core functionality.
[DATA_EXFILTRATION]: The planning script accesses the local model catalog and role definitions to determine readiness. This access is limited to the skill's operational requirements (inspecting configured models) and does not involve sensitive user credentials like SSH keys, AWS credentials, or environment secrets. No network operations were detected that would allow for data exfiltration.

crack-plan