The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external implementation plans and task descriptions, creating a surface for indirect prompt injection where malicious instructions in a plan could influence subagent behavior.
Ingestion points: The workflow reads implementation plans (e.g., docs/superpowers/plans/feature-plan.md) and extracts task descriptions to feed into subagent prompts in implementer-prompt.md and spec-reviewer-prompt.md.
Capability inventory: Subagents are granted capabilities to write/modify code files, execute tests, and perform git operations such as commits.
Boundary markers: The prompt templates utilize markdown headers (## Task Description, ## Context) to delimit data, but they lack explicit instructions for the subagents to ignore or treat instructions within the task description as data rather than commands.
Sanitization: There is no mentioned process for sanitizing or validating the contents of the implementation plan before it is processed.
Risk Factor: The "Continuous execution" directive in SKILL.md instructs the agent to execute all tasks without human intervention, which could allow a malicious plan to perform multiple unauthorized actions sequentially before detection.

subagent-driven-development