The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from requirements.md and design.md to generate implementation tasks, presenting an attack surface for instructions embedded in those documents.
Ingestion points: Untrusted data enters the agent context through the reading of requirements.md, design.md, and various documentation files in the docs/ directory.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands specified when processing these external inputs.
Capability inventory: The skill triggers follow-on actions including file system writes and the invocation of execution skills (build-in-waves, build-by-story, build-inline) which may modify the codebase.
Sanitization: The skill does not describe any specific sanitization, validation, or escaping of the content ingested from the requirements and design files.
[COMMAND_EXECUTION]: The skill utilizes local shell commands such as git check-ignore and grep for repository state verification and collision detection between different task plans. These calls are restricted to analyzing the local repository structure.

plan-tasks