The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an inherent surface for indirect prompt injection due to its core design of building execution plans from external data.
Ingestion points: The OODAObserver class in references/ooda-loop-patterns.md gathers situational context through recursive workspace file scans and user message parsing.
Boundary markers: The implementation patterns provided in the documentation do not show the use of explicit delimiters or isolation markers to separate untrusted ingested content from the agent's internal planning instructions.
Capability inventory: The framework is built to trigger actions with significant side effects, including run_command and replace_file_content, as described in references/plan-execute-architectures.md and references/task-decomposition-strategies.md.
Sanitization: The provided Python and TypeScript logic for intent classification and goal decomposition lacks specific filtering or escaping mechanisms to prevent instructions embedded within analyzed files from influencing the generated plan artifact.

feedforward-controls