The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of Bash scripts and Node.js utilities to perform filesystem and Git operations. It uses eval to execute commands returned by helper scripts and to run configurable post-task commands.
Evidence in references/executor-instructions.md: The executor subagent is instructed to run eval "$POST_TASK_CMD" where the command is read from a local configuration file.
Evidence in SKILL.md: The orchestrator uses eval "$BRANCH_OUTPUT" and eval "$WT_OUTPUT" to process variables returned by Bash scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external files like PLAN.md, ROADMAP.md, and general codebase files into the prompts of subagents using the Task() tool. This creates a surface where malicious instructions embedded in project files could influence agent behavior.
Ingestion points: The orchestrator reads PLAN.md files and injects their content directly into executor agent prompts.
Boundary markers: The skill uses XML-like tags (e.g., <plan>, <project_state>) to delimit injected content, which provides some protection against accidental instruction following.
Capability inventory: Subagents are spawned as general-purpose agents with full shell access and filesystem permissions within their working directory.
Sanitization: There is no evidence of explicit escaping or sanitization of the interpolated file content before it is passed to the subagents.
[EXTERNAL_DOWNLOADS]: The skill documentation and checkpoint logic encourage the installation of external tools and services such as vercel, gh, stripe, and supabase using standard package managers like npm, brew, or apt.
Evidence in references/checkpoints.md: The skill includes a reference table for various CLI tools and provides instructions for their installation.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes Git commands for branch and worktree management. It also automatically runs the project's test suite (e.g., npm test) as part of its verification process.
Evidence in SKILL.md: Step 6.5 automatically detects and runs the test script defined in the project's package.json.

kata-execute-phase