The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project files that could contain malicious instructions.
Ingestion points: Reads content from spec.md, conductor/tracks.md, conductor/product.md, and conductor/tech-stack.md (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or instructions to treat input file content strictly as data.
Capability inventory: The skill has file system access via read_file and write_file (SKILL.md).
Sanitization: There is no evidence of sanitization or filtering of the content ingested from the project files before it is used to generate the plan.
[DYNAMIC_EXECUTION]: The skill generates executable content in the form of code snippets and shell commands.
Evidence: The skill instructions include templates for generating TypeScript code, failing tests, and shell commands like npm test and git commit (SKILL.md, section 3.2).
Context: While these are intended as templates for a human developer or a downstream agent to review and execute, they are dynamically generated based on the input specifications.

loop-planner