The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its technical plan ingestion mechanism.
Ingestion points: The scripts/ingest_plan.py script reads external Markdown files to populate the task backlog.
Boundary markers: Security delimiters are absent. The scripts/context_curator.py templates (e.g., task_greenfield.j2) interpolate task titles and descriptions directly into worker prompts without using markers or instructions to ignore embedded commands.
Capability inventory: Sub-processes are spawned via the claude CLI with the --dangerously-skip-permissions flag, allowing them to autonomously execute shell commands and modify the file system.
Sanitization: There is no evidence of validation or sanitization of the task content extracted from Markdown files before it is processed into prompts for the autonomous workers.
[COMMAND_EXECUTION]: The scripts/orchestrate.py script manages worker lifecycles by executing the claude CLI through subprocess.Popen. It explicitly utilizes the --dangerously-skip-permissions flag and sets the IS_SANDBOX=1 environment variable. This configuration enables the sub-agents to perform sensitive operations (file writes, command execution) without human-in-the-loop verification. While this is the intended design for autonomous orchestration, it significantly increases the potential impact of a successful prompt injection attack.

project-manager