The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by parsing user-provided markdown plan files and interpolating their contents (descriptions, goals, tasks) directly into subagent prompt templates without sanitization or boundary markers. This could allow an attacker to influence subagent behavior via a malicious plan file. Evidence Chain: 1. Ingestion points: Plan files () and persistence files (.tasks.json). 2. Boundary markers: Absent. The content is inserted into subagent templates without delimiters or 'ignore embedded instructions' warnings. 3. Capability inventory: Subagents have general-purpose capabilities and are explicitly instructed to execute validation commands from the plan. 4. Sanitization: Absent. No escaping or validation of the plan content is performed before interpolation.
[COMMAND_EXECUTION]: The subagent instructions explicitly direct the agent to run validation commands provided within the plan file ('Validation: [commands/tests from plan]'). This allows for the execution of arbitrary shell commands if the source plan file is compromised or untrusted.

swarm-executor