The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute instructions from external implementation plans, creating a surface for indirect prompt injection.
Ingestion points: The skill reads implementation instructions from the plan_path variable (typically located in run_dir/03-plans/).
Boundary markers: There are no explicit boundary markers or system instructions to ignore malicious directives embedded within the plan file; the agent is instead told to "Execute strictly per plan."
Capability inventory: The skill is capable of executing shell commands, running builds, executing tests, and performing file operations (e.g., updating logs/state.json) as dictated by the plan.
Sanitization: No programmatic sanitization or filtering is applied to the content of the plan file. The skill relies on an internal "Critical Review" step and mandatory human feedback after every batch of three tasks to mitigate risks.
[COMMAND_EXECUTION]: The skill performs command execution based on inputs provided in the plan file.
Evidence: Instructions to "Run verification per plan (tests / build / typecheck / lint / manual verification steps)" and to "Run full tests/build" indicate the skill will spawn subprocesses or execute shell commands derived from the implementation plan.

workflow-execute-plans