The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes plan artifacts (plan.md and task files) that are inherently untrusted data sources. These artifacts contain natural language instructions that drive the behavior of subagents.\n
Ingestion points: The orchestrator reads the plan index at 'plan.md' and individual task briefs in the 'plan-tasks/' directory.\n
Boundary markers: The skill uses self-contained briefs to restrict subagent scope and specifies that subagents should not read from the plan beyond their assigned task file and the index.\n
Capability inventory: The skill dispatches subagents with permissions to modify source code and execute shell commands (e.g., project gates, verification scripts). The orchestrator also performs git commits based on this output.\n
Sanitization: There is no evidence of content sanitization or instruction filtering for the data ingested from the plan artifacts.\n- [COMMAND_EXECUTION]: The orchestrator and its subagents execute shell commands to verify implementation tasks and enforce project quality standards. This involves running 'verification blocks' (such as npm test or grep) defined within the plan files, as well as 'standing gates' (such as linters and type-checkers) configured in the project repository.\n- [SAFE]: The skill incorporates significant repository safety mechanisms, including a mandatory preflight check that refuses execution on a dirty worktree unless explicitly authorized, and a strict policy against git history rewriting operations like amending, rebasing, or force-pushing.

implement-plan-with-subagents