The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes task descriptions from a user-specified TODO.md file and interpolates them directly into the instructions for subagents.
Ingestion points: The skill reads the file path provided in $ARGUMENTS (SKILL.md, lines 270 and 491) and extracts task titles and descriptions.
Boundary markers: While the prompt uses markdown headers like '## Task Context', it lacks specific delimiters or 'ignore embedded instructions' warnings to prevent the content of the TODO file from overriding the agent's logic (SKILL.md, lines 346-356).
Capability inventory: The skill uses the Task tool to invoke subagents for 'general-purpose' implementation and 'Explore' investigation tasks. These subagents have the capability to create and modify files in the codebase.
Sanitization: There is no evidence of sanitization or filtering applied to the task descriptions before they are used as prompts for subagents.
[COMMAND_EXECUTION]: The skill is designed to systematically execute a sequence of tasks. If a malicious TODO file is provided, an attacker could induce the agent to perform unauthorized file modifications or investigations via the subagent Task tool.
[PERSISTENCE]: The skill contains logic that forces the agent to remain in an execution loop ('NEVER end the session while incomplete tasks remain', line 155) until all tasks are marked as complete. This behavior, combined with the lack of sanitization, could be exploited to create infinite loops or resource exhaustion if a task description modifies the TODO file to add new incomplete tasks.

todo-task-run