The Agent Skills Directory

[COMMAND_EXECUTION]: The skill identifies and executes shell commands defined within project plan files under the ## VALIDATION COMMANDS section. While it advises caution regarding destructive operations, the execution of commands derived from external data files represents a command injection risk if those files are modified by an adversary.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from implementation plans, request descriptions, and specific criteria files to determine its validation logic. Maliciously crafted content in these sources could influence the agent's behavior or force a false validation verdict.
Ingestion points: Content is read from .agents/plans/*.md, acceptance_criteria.md, and the user's initial request description in SKILL.md (Steps 1 and 2).
Boundary markers: The skill lacks explicit delimiters or instructions to treat ingested content as data rather than instructions, making it susceptible to embedded directives.
Capability inventory: The skill has the capability to execute arbitrary shell commands (Validation Commands), perform network probes (curl), and write validation reports to the file system.
Sanitization: There is no evidence of sanitization or validation for the commands extracted from plan files before they are passed to the shell.
[DYNAMIC_EXECUTION]: The skill utilizes python -c "import <module>" to perform structural probes. This pattern involves the dynamic execution of string-based code to verify the environment and code integrity, which could be exploited if the module name is manipulated.

acceptance-criteria-validate