The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection during its discovery phase.
Ingestion points: In Phase 1 (Discovery), the agent is instructed to read key files, directory structures, and build configurations from the repository to map dependencies and patterns.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions potentially embedded within the files it reads.
Capability inventory: The skill utilizes Bash, Read, Write, Glob, and Grep to inspect the filesystem and generate the plan document.
Sanitization: The skill lacks explicit sanitization or validation logic for content read from the codebase before it is used to generate implementation steps.
[SAFE]: The skill includes several security-positive design patterns.
Human-in-the-loop: Phase 4 (Approval Gate) strictly requires explicit user approval of the generated plan before any work proceeds.
Limited Scope: The skill documentation explicitly states that implementation is out of scope for this tool, focusing only on the planning phase.
Model Constraints: The frontmatter includes disable-model-invocation: true, which restricts the agent's ability to autonomously call other models or tools during the execution of this specific skill.

exec-plan