The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted user input to define a 'problem set' and subsequently interpolates these descriptions into templates for several sub-agents (Opus and Codex) across various phases.\n
Ingestion Points: User-provided problem descriptions are extracted from the conversation context during Phase 0 and stored in root plan files.\n
Boundary Markers: The templates in references/agent-prompts.md use Markdown headers (e.g., ## Your Problem) and ID markers (e.g., {problem_id}), but they lack explicit instructions for the models to ignore or treat embedded commands within the problem description as data rather than instructions.\n
Capability Inventory: Sub-agents have the ability to read and write to the filesystem (via the $plan pattern) and their findings directly influence the construction of implementation scaffolds, which could be manipulated to include malicious code or configurations.\n
Sanitization: There is no evidence of escaping, validation, or filtering of the user-provided content before it is processed by the reasoning models.

deep-sweep