The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several platform hooks (UserPromptSubmit, PreToolUse, PostToolUse, Stop, PreCompact) to execute local Shell and PowerShell scripts. These scripts manage task state, update progress ledgers, and handle context injection.
[DATA_EXPOSURE]: The session-catchup.py script accesses local session history stored in ~/.claude/projects/ and ~/.local/share/opencode/opencode.db. This is used to reconstruct the agent's context after a session clear, allowing it to recover the state of active planning files from previous conversation logs.
[PROMPT_INJECTION]: The skill explicitly addresses indirect prompt injection risks by providing two layers of defense: delimiter framing (wrapping injected data in identifiable markers) and opt-in SHA-256 attestation. The attestation feature (/plan-attest) ensures the agent only processes plan files that have been explicitly approved by the user, blocking injection if the files are modified by untrusted external content.
[SAFE]: All scripts incorporate security best practices, such as containment guards to ensure file operations remain within the project root and strict input validation (e.g., slug_is_valid) to prevent directory traversal or command injection via user-supplied plan identifiers.
[SAFE]: The 'gated mode' implemented in the Stop hook allows the skill to act as a termination oracle, optionally blocking the agent from stopping if the task plan is not marked as complete. This is a legitimate workflow management feature designed for autonomous operation.

planning-with-files