The Agent Skills Directory

[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by ingesting plan artifacts (plan.md and plan-tasks/*.md) and instructing the agent to execute the steps and substeps literally. Evidence: Ingestion points are the plan artifacts in docs/threads/ folders; Boundary markers are absent; Capability inventory includes git operations, file modifications, and execution of project scripts; Sanitization is absent. This allows a malicious plan to override agent behavior.
[COMMAND_EXECUTION]: The skill invokes shell commands such as git status, git add, and git commit. It also executes project-defined scripts like check, lint, format, typecheck, and npm test. Maliciously crafted project configurations or plan instructions could exploit these execution paths to run arbitrary code on the host system.

implement-plan