The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from local project files (HTML, Markdown, and JavaScript) to generate a summary and research citations for the agent. This represents a surface for indirect prompt injection, where malicious instructions hidden in the plan documents could influence the agent's behavior during the planning phase.
Ingestion points: Content is read from plan.html, execution.md, outcome.md, README.md, and board-events.js located within the qstack/compound_engineering/plans/ and compound-engineering/plans/ directories.
Boundary markers: The skill does not implement specific delimiters or "ignore instructions" warnings when presenting the content of these files to the agent.
Capability inventory: The skill uses shell commands (find, grep) to search files and performs JavaScript syntax validation using node --check. It is described as read-only and does not perform network operations or write to the filesystem.
Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested text before it is provided to the agent context.

qstack-plan-prior-art