The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions specify invoking a Python script via uv run python scripts/dev/active_plan.py --feature <slug>, where <slug> is sourced directly from user-provided $ARGUMENTS or conversation context. If the platform executing this command does not perform strict sanitization of shell metacharacters, this pattern is vulnerable to command injection.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from local project files (e.g., PLAN.md) and returns the contents as the 'next task' for the agent to process. An attacker who can modify these project files (e.g., through a malicious pull request) could embed instructions that the agent might inadvertently execute.
Ingestion points: The scripts/dev/active_plan.py script reads PLAN.md and feature-specific markdown files from the local repository.
Boundary markers: The skill does not define boundary markers or instruct the agent to ignore instructions embedded within the plan files.
Capability inventory: The skill environment has the capability to execute shell commands and Python scripts.
Sanitization: There is no mention of sanitizing the file contents before they are returned to the agent's context.

status