The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted plan files which could contain instructions designed to bypass agent constraints or perform unauthorized actions during the implementation phase.
Ingestion points: The agent reads data from .specs/plans/<slug>.md, where <slug> is a user-provided argument or selected from a list of files in the workspace.
Boundary markers: No explicit delimiters (e.g., XML tags or triple quotes) or 'ignore embedded instructions' warnings are implemented when the agent reads the plan content.
Capability inventory: The skill has significant capabilities including reading/writing any file in the workspace, executing shell commands (tests, linters, build tools), creating git branches, and performing git commits.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content within the plan files before the agent follows the instructions contained therein.
[COMMAND_EXECUTION]: The skill automatically detects and executes arbitrary scripts defined in the project's manifest files (e.g., package.json, pyproject.toml, go.mod, Cargo.toml).
Evidence: Step 6 ('Run feedback loops') explicitly instructs the agent to run commands such as npm run test, pytest, cargo test, or make. While this is intended for validation, an attacker-controlled repository could contain malicious code within these scripts that would be executed by the agent during the build process.

build