The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to perform directory cleanup using rm -rf .claude/plans/<plan-id>/ after task completion. The <plan-id> variable is derived from external plan files, which could lead to path traversal if the ID is not validated by the agent platform.
[COMMAND_EXECUTION]: The code quality reviewer prompt template includes a command for verifying peer dependencies using node -e "console.log(require('<pkg>/package.json').peerDependencies)". Additionally, the implementer prompt instructs the agent to verify the current git branch using git branch --show-current.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and act upon instructions from external files, creating an attack surface where a malicious plan file could influence agent behavior.
Ingestion points: plan.md, manifest.json, and task-specific briefing files (e.g., task-NN.md) located in project subdirectories.
Boundary markers: The skill uses markdown headers in prompt templates (e.g., ## Task Specification, ## Your Briefing) to separate system instructions from task-specific data.
Capability inventory: Capabilities include file deletion, shell command execution via Node.js and Git, and the ability to dispatch and instruct new subagent sessions.
Sanitization: No explicit validation or escaping is defined for plan identifiers or briefing content before they are interpolated into shell commands or subagent prompts.

subagent-driven-development