The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from a file path provided via $ARGUMENTS and extracts raw text fields (Title, Goal, Spec, Chunks) which are subsequently passed as contextual prose to the work-backlog-item skill.
Ingestion points: The Read tool is used to ingest the entire content of the file path specified in $ARGUMENTS (SKILL.md, Step 1).
Boundary markers: The skill does not implement boundary markers or 'ignore' instructions when passing the extracted plan content to the downstream skill.
Capability inventory: The skill has access to Read, Edit, the work-backlog-item skill delegation, mcp__plugin_dh_backlog__backlog_add, and subprocess execution via uv run (SKILL.md, Steps 1-7).
Sanitization: There is no sanitization or escaping of the extracted text before it is interpolated into the delegation prompt for work-backlog-item.
[COMMAND_EXECUTION]: The skill executes a local CLI tool using uv run "${CLAUDE_PLUGIN_ROOT}/sam_schema/cli.py" plan list to resolve plan addresses if they are not found in the delegated skill output. This relies on the environment variable CLAUDE_PLUGIN_ROOT and executes a Python script within the agent's environment.
[DATA_EXFILTRATION]: The skill utilizes the Read tool on an arbitrary file path provided by the user in $ARGUMENTS. Although the skill includes validation steps to check for specific markdown patterns (#, **Goal:**), a malicious path could result in sensitive file content being ingested into the LLM context if it happens to contain or mimic the expected markers.

interop