The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from Markdown files (active backlog, archive, and extra details) that may contain untrusted data. If these files contain instructions designed to override the agent's behavior, the agent might inadvertently follow them during parsing or reporting tasks.
Ingestion points: The skill reads data from todo_path (default docs/todo/TODO.md), archive_path (docs/todo/TODO_ARCHIVE.md), and extra_path (docs/todo/TODO_EXTRA.md).
Boundary markers: The instructions do not define explicit delimiters (e.g., XML tags or triple quotes) or provide the agent with a 'system-level' directive to ignore any instructions embedded within the TODO items themselves.
Capability inventory: The skill has permissions to read, create, and modify files at the configured paths, including the ability to move content between files (archiving) and delete lines from the active backlog.
Sanitization: There is no mechanism described to sanitize, escape, or validate the natural language content within the TODO descriptions before it is presented back to the agent or written to other files.

todo-manager