The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, specifically PRDs, specs, and plan briefs, which are used to populate the context of a subagent. The prompt skeleton provided in SKILL.md for the subagent lacks explicit boundary markers or delimiters (e.g., XML tags or clear 'ignore embedded instructions' directives) to separate the instruction block from the processed data. Given the skill's capabilities to write to the filesystem and spawn further agents, a malicious specification could theoretically contain instructions that influence the subagent's output or downstream commands.
Ingestion points: The <plan file or brief> variable in the subagent prompt skeleton, derived from user-provided project documentation.
Boundary markers: Absent from the subagent prompt skeleton.
Capability inventory: Access to Bash, Write, Edit, Agent, and AskUserQuestion tools.
Sanitization: No explicit sanitization or validation of the input text is described before it is passed to the subagent.
[COMMAND_EXECUTION]: The skill documentation explicitly recommends using the Bash tool to perform integrity checks on generated files. While the suggested commands (wc -l and tail -c 60) are benign validation utilities, the skill's design encourages the execution of shell commands based on internal logic to prevent file truncation issues.

planning-pipeline