The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources that could contain malicious instructions.
Ingestion points: The scripts scripts/list-templates.sh and scripts/kata-lib.cjs scan and read all Markdown files located in the references/ subdirectories of any sibling skill folders matching the kata-* naming pattern.
Boundary markers: No delimiters or safety instructions are used when displaying or processing the content of these external template files before they are presented to the agent or the user.
Capability inventory: The skill facilitates reading, copying, and editing files within the local project environment, specifically targeting the .planning/templates/ directory.
Sanitization: The scripts utilize a basic, non-robust custom YAML parser to extract metadata, providing no protection against malicious content or prompt injection attacks embedded in the template body or metadata fields.
[COMMAND_EXECUTION]: The skill executes shell commands and Node.js scripts that incorporate user-provided inputs without adequate sanitization.
Evidence: In scripts/kata-lib.cjs, the resolve-template command joins the user-supplied templateName argument into file paths using path.join. It does not perform validation or sanitization for path traversal sequences like ../, which could be exploited to resolve, read, or copy sensitive files outside the intended project directories if a malicious template name is provided.

kata-customize