The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses platform hooks (UserPromptSubmit and PreToolUse) to automatically inject content from local files like task_plan.md and progress.md into the agent's context window. This creates a persistent attack surface for Indirect Prompt Injection, where malicious instructions from external sources (e.g., web research) could be saved into these files and executed by the agent in subsequent steps.
[COMMAND_EXECUTION]: The skill frequently executes shell commands and local scripts through hooks to manage context. This includes using powershell.exe -ExecutionPolicy Bypass in the Stop hook and SKILL.md instructions, which explicitly circumvents local security policies to run the skill's own automation scripts.
[COMMAND_EXECUTION]: The session-catchup.py script accesses and reads internal platform data from sensitive directories, specifically ~/.claude/projects/ and ~/.codex/sessions/, to find previous conversation logs and restore state. While functional for session recovery, it involves reading system-level application data.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Reads task_plan.md, findings.md, and progress.md via PreToolUse hooks and SKILL.md instructions.
Boundary markers: None; the content is injected via direct cat or head command output into the prompt.
Capability inventory: Uses Bash, Write, Edit, Read, Glob, and Grep across multiple scripts.
Sanitization: None; external research results are written directly to files that are later re-read into the context.

planning-with-files