The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from the web via WebFetch and WebSearch and encourages saving it to local markdown files such as findings.md and task_plan.md. These files are automatically read back into the agent's context during PreToolUse hooks and session recovery steps. This creates a surface where malicious instructions found on an external website could be stored and subsequently influence the agent's behavior.
Ingestion points: Output from WebFetch and WebSearch tools.
Boundary markers: None identified in instructions for data storage or retrieval.
Capability inventory: The agent has access to powerful tools including Bash, Write, and Edit.
Sanitization: No sanitization or validation of external content is specified before it is written to the persistent planning files.
[COMMAND_EXECUTION]: The skill utilizes automated shell and Python scripts (check-complete.sh, session-catchup.py) during session events (such as the Stop hook) and as part of its recommended recovery workflow. These scripts are part of the skill's own package but execute logic in the host environment using the current working directory as an argument.
[PRIVILEGE_ESCALATION]: The skill's configuration for Windows systems explicitly uses -ExecutionPolicy Bypass when calling its internal PowerShell scripts (check-complete.ps1). While used for its own components, this pattern bypasses established system security policies for script execution.

planning-with-files