The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the Researcher component ingests data from local repository files and external URLs, which then influences the Planner and Reviewer roles.
Ingestion points: The Researcher sub-agent reads files from the current repository and can fetch external documentation or web content if approved by the user (references/researcher.md).
Boundary markers: The skill does not define explicit delimiters or boundary markers to isolate untrusted external content from its own instructions.
Capability inventory: The skill adopts a strict "no-action" policy, explicitly forbidding file creation, modification, deletion, and unauthorized command execution until explicit user approval is granted (SKILL.md, references/delegation.md).
Sanitization: No sanitization or filtering logic is specified for the data gathered from repository files or external sources.
[DATA_EXFILTRATION]: The skill includes robust safeguards against data exfiltration, specifically banning the access of sensitive files like .env, API keys, or personal information, and prohibiting sub-agents from performing external writes or commits without user permission.
[EXTERNAL_DOWNLOADS]: The Researcher component is capable of fetching data from external URLs, such as standards or API documentation. This is governed by a mandatory user-approval checkpoint before any external request is made.
[COMMAND_EXECUTION]: The skill implements a defensive posture regarding command execution, ensuring that all environment-altering actions (e.g., dependency installation, migrations) require a human checkpoint and explicit authorization.

global-async-planning-pipeline