The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from plan files and interpolates it into system-level prompts for subagents, creating a vulnerability surface for instruction override.
Ingestion points: The skill reads Markdown (.md) and HTML (.html) files from the docs/plans/ directory during Phase 1 to define the execution workflow.
Boundary markers: The prompt templates in references/subagent-prompts.md use simple headers like OBJECTIVE:, ACCEPTANCE CRITERIA:, and INSTRUCTIONS: to delimit content, but they do not include explicit instructions for the subagents to ignore potentially malicious directions embedded within the plan data.
Capability inventory: Build and Remediation subagents are granted "full filesystem access" to perform implementation tasks. The Verification subagent has the capability to execute shell commands.
Sanitization: The skill instructions explicitly state that placeholders should be substituted with content copied "verbatim" from the plan files, ensuring that any malicious payloads in the plan are passed directly to the subagents.
[COMMAND_EXECUTION]: The Verification subagent executes arbitrary shell commands defined in the plan's toolchain configuration.
Evidence: The skill extracts the TOOL_CHAIN_CONFIG (e.g., test runners, linters) from the plan file and instructs the Verification subagent to "Execute each checklist item by running the actual tools." If a plan file contains malicious commands in its Tool Chain table, the subagent will execute them during the verification phase.

execute-blueprint