The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user requests and integrates them into project management files such as pieces.md and masterplan.md.
Ingestion points: User-provided plain language requests are ingested in SKILL.md through the /plan command.
Capability inventory: Although this skill is configured with disable-model-invocation: true and cannot execute code directly, it performs file-write operations. The resulting files are intended to be processed by the /implement command, which possesses building/execution capabilities.
Boundary markers: The instructions lack specific guidance on using delimiters, escaping, or boundary markers when interpolating user input into the structured 'piece' format, increasing the risk that malicious instructions could be passed to downstream tools.
Sanitization: There is no evidence of input validation or sanitization being applied to user requests before they are recorded in the project documentation.

plan