The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves loading and executing instructions from external files, which can be exploited to inject malicious prompts. * Ingestion points: The skill reads orchestration plans (plan.md), manifests (manifest.json), and task-specific briefings (briefings/task-NN.md) from the .claude/plans/ or docs/plans/ directories. * Boundary markers: No technical delimiters or 'ignore' instructions are used to isolate the data in these files from the agent's core instructions; it relies solely on a logical instruction to 'review critically'. * Capability inventory: The agent is empowered to execute tasks that involve file modifications, verifications, and git operations (via the git-workflow sub-skill). * Sanitization: There is no mechanism described to sanitize or validate the content of the plans before execution.
[COMMAND_EXECUTION]: The skill explicitly directs the agent to perform filesystem cleanup using shell commands. * Evidence: In Step 5, the skill instructs the agent to 'Delete the plan directory: rm -rf .claude/plans/<plan-id>/'. This involves executing a potentially destructive command with a dynamic path parameter.

executing-plans