The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection because it processes untrusted data from external markdown files. \n- Ingestion points: The skill identifies and reads content from .specs/plans/<slug>.md or globs files matching .specs/plans/*.md based on user input or automated discovery. \n- Boundary markers: The instructions lack explicit boundary markers or 'ignore embedded instructions' warnings when the plan content is passed to the subagent. \n- Capability inventory: The skill utilizes a 'general-purpose' subagent that has read-only access to the codebase. The primary skill is capable of writing back to plan files to update implementation checkboxes. \n- Sanitization: There is no evidence of content sanitization or validation of the external plan files before their contents are processed by the subagent.

test