The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads task-specific instructions from an external file and interpolates them directly into subagent prompts.
Ingestion points: Task names and requirements are read from a user-provided or session-local plan file in Step 1 and Step 2 (SKILL.md).
Boundary markers: The subagent prompt templates lack explicit delimiters (such as XML tags or triple backticks) or specific instructions to ignore malicious directives embedded within the task text.
Capability inventory: The subagents are granted capabilities to implement source code, write tests, and commit changes to the repository, which can be exploited if the plan file contains malicious instructions.
Sanitization: No input validation or filtering is performed on the content of the plan file before it is used to direct the agent's actions.
[COMMAND_EXECUTION]: The skill workflow involves dynamic code generation and execution as part of its primary function.
Execution method: Subagents are instructed to write code and tests, then execute those tests to verify functionality (SKILL.md).
Risk factor: While standard for development agents, the execution of generated code based on external plan files inherits the risks of the indirect prompt injection surface.
[NO_CODE]: The skill package consists solely of markdown instructions and metadata, containing no standalone executable scripts, binaries, or configuration files that could hide malicious logic.

subagent-driven-development