The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the ! command syntax in SKILL.md and references/research-patterns.md to execute shell commands during skill load. These commands are used for project state awareness (checking if the .prompts folder exists, listing recent research/plan files) and for retrieving the current date to ensure research sources are current. These operations are limited to the project's own directory and do not attempt to access sensitive system files or environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (task descriptions) and reads data from generated markdown files (*-research.md, *-plan.md), which represents an ingestion surface for indirect prompt injection. The skill implements robust defenses against this by enforcing strict XML-based boundary markers and structured metadata formats for all generated outputs. The mandatory evidence chain includes:
Ingestion points: User input via the /create-meta-prompt command and file reads from the .prompts/ directory.
Boundary markers: Heavy use of XML tags (e.g., <objective>, <context>, <research_scope>) to isolate untrusted content.
Capability inventory: Spawning of sub-agents, file writing to local folders, and directory listing.
Sanitization: Instructions prioritize structured output to ensure subsequent agents can reliably distinguish between instructions and data.

create-meta-prompts