The Agent Skills Directory

[COMMAND_EXECUTION]: The skill takes user input from $ARGUMENTS and interpolates it into bash shell commands without sufficient sanitization. In SKILL.md, Step 1 uses grep -A5 "Phase ${PHASE}:" .planning/ROADMAP.md where ${PHASE} can be controlled by a user to execute arbitrary shell commands (e.g., by providing 1\"; id; # as the phase number). Similar patterns exist in Step 2 and Step 3 where the variable is used in find, ls, and cat commands.
[INDIRECT_PROMPT_INJECTION]: The skill spawns a kata-phase-researcher subagent that is explicitly instructed to use WebSearch and WebFetch to gather information from the internet. This untrusted content could contain malicious instructions designed to alter the subagent's research output or manipulate the planning process.
Ingestion points: External data enters the context through WebSearch and WebFetch operations as defined in references/phase-researcher-instructions.md.
Boundary markers: The instructions command the agent to produce a structured RESEARCH.md file, but there are no boundary markers or instructions to isolate or treat external content as untrusted data during processing.
Capability inventory: The subagent has the capability to write research files to the project's .planning directory and commit those changes to a git repository.
Sanitization: The skill relies on a soft "Verification Protocol" (asking the LLM to cross-reference sources) rather than technical sanitization or filtering of the ingested content.
[EXTERNAL_DOWNLOADS]: The researcher subagent is instructed to download documentation and community patterns from various external sources using WebFetch and search engines.
[DYNAMIC_EXECUTION]: The skill uses the Task() function to dynamically generate prompts and spawn a subagent at runtime. It also executes a local Node.js script scripts/kata-lib.cjs to manage project configurations.

kata-research-phase