The Agent Skills Directory

[SAFE]: The skill functions as a static document validator. It reads project context files (specifications, glossaries, and decision records) and applies corrections to plan documents within the local plans/ directory. No external network requests, data exfiltration, or persistence mechanisms were detected.
[SAFE]: The agent's configuration explicitly disables model-initiated tool invocation. The skill does not utilize subprocesses, shell commands, or dynamic code execution to perform its tasks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the repository's spec.md and plan folders to drive its editing logic.
Ingestion points: spec.md, plans/, AGENTS.md, docs/glossary.md, docs/adr/, and docs/pdr/.
Boundary markers: None explicitly present; the instructions treat the content of spec.md as the authoritative source for changes.
Capability inventory: File system read access and write access restricted to the plans/ and .pending-decisions/ folders.
Sanitization: No explicit sanitization or escaping of external content before interpolation.
Assessment: While the skill has an ingestion surface, the risk is mitigated by the extremely narrow scope of its write capabilities, which are limited to updating markdown task objectives and titles based on verbatim spec quotations.

check-plan