The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Anti-Drift Protocol' and 'Critical Meta-Goals' contain instructions that attempt to override the agent's standard behavior and prior instructions. Phrases such as 'Your memory has been wiped', 'Trust ONLY the plan', 'The plan is the only truth', and 'If it's not in the plan, it didn't happen' are used to establish an external file as the absolute authority, which can be used to bypass system prompts or safety guardrails.
[PROMPT_INJECTION]: The skill creates a vulnerability to Indirect Prompt Injection by instructing the agent to ingest and obey instructions from external files.
Ingestion points: Reads content from AI_PROGRESS/[task_name]/plan.md using cat and tail commands.
Boundary markers: None. The instructions explicitly state the file is the 'SINGLE SOURCE OF TRUTH', discouraging the use of internal boundary checks.
Capability inventory: The agent is encouraged to run shell commands, development tools like ruff or mypy, and the GitHub CLI (gh) based on the plan's contents.
Sanitization: There is no evidence of sanitization or validation of the plan file's content before the agent executes the steps described within it.

plan