The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes plan folders (plans/) and task briefs (plan-tasks/) which are ingestion points for external data that could contain malicious instructions designed to manipulate agent behavior.
Ingestion points: plans/plan.md, plan-tasks/NN-<kebab-slug>.md, and change.md (specified in SKILL.md).
Boundary markers: The skill enforces a strict folder structure and mandatory fields (Objective, Verification, etc.), but lacks explicit boundary delimiters to prevent the model from following instructions embedded within those fields.
Capability inventory: The skill has permissions to write to the file system, perform git commit operations, and execute shell commands defined in verification blocks.
Sanitization: Relies on an in-session self-review pass where the agent evaluates its own diff against criteria quoted from the (potentially untrusted) brief.
[COMMAND_EXECUTION]: The skill executes git commands (status, commit, log) for version control automation. It also executes shell commands provided in the "Verification" block of plan briefs, such as grep or test invocations.
[DYNAMIC_EXECUTION]: Verification blocks in task briefs are executed dynamically during the task implementation process to confirm criteria are met. This involves executing arbitrary commands defined in local markdown files.
[PROMPT_INJECTION]: The skill includes directives that instruct the agent to "not pause for clarifying questions" and "not ask before committing," establishing an autonomous posture that overrides standard interactive safety checks and human-in-the-loop oversight.

implement-plan