The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user requirements and existing codebase context to generate implementation plans (.plan/task_plan.md). These plans include concrete verification tasks and test commands that the agent is expected to execute to validate its work. This creates a surface where a malicious user could provide requirements that lead to the generation of harmful commands in the 'Verify' or 'Tasks' sections of the plan, which the agent might then execute without further review.
Ingestion points: User-provided feature requirements and stated goals (SKILL.md Procedure 1) and existing source code/tests (SKILL.md Procedure 4).
Boundary markers: The skill uses a structured plan template and creates a dedicated .plan/ directory (added to .gitignore via init-plan.sh) to isolate session state, but it lacks explicit warnings or automated sanitization to prevent the interpolation of malicious instructions from the input data into the output plan.
Capability inventory: The skill executes a bundled local script (scripts/init-plan.sh) to scaffold files and creates plans that direct the agent to perform tool calls, shell command execution, and filesystem operations in subsequent implementation phases.
Sanitization: There is no automated sanitization of user-provided strings; the skill relies on the agent's internal reasoning and 'Plan Quality Rules' (references/plan-format.md) to ensure the generated tasks are appropriate.

planning