The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to run a shell script using the command sh .agents/tools/plan-refresh.sh. Direct execution of shell scripts by an agent allows for arbitrary command execution on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from plan.local.md, which is an external file that could be influenced by other users or processes.
Ingestion points: The agent is instructed to read plan.local.md as its primary source of truth.
Boundary markers: There are no boundary markers or instructions to treat the file content as untrusted data, increasing the risk that the agent might follow instructions embedded within the plan.
Capability inventory: The skill possesses the capability to execute shell commands (sh).
Sanitization: No sanitization or validation of the plan file's content is specified before the agent processes and reports it.
[DYNAMIC_EXECUTION]: The skill directs the agent to a fallback instruction in references/pieces.md if the primary helper script is missing, telling it to execute "what to run instead." This creates a dynamic execution path where the agent may run unverified commands based on external reference content.

queue