The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted plan files.
Ingestion points: The skill reads the content of an external plan file specified via the Path argument in Step 1.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands when passing the plan content to the sub-agents in Step 3.
Capability inventory: The skill can spawn five parallel agents using the Task tool, load additional skills using the Skill tool, and write review reports to the local file system.
Sanitization: The skill does not perform any sanitization, validation, or escaping of the input plan content before it is interpolated into the prompts for the sub-agents.
[COMMAND_EXECUTION]: While the skill orchestrates other agents, it does not directly execute arbitrary shell commands. It uses platform-specific Task and Skill tools to perform its logic.

review-plan