The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted plan files to generate a YAML checklist that drives future agent behavior and command execution, creating a potential vector for instruction injection.
Ingestion points: The skill reads project plans from directories including docs/, .vault/, and the agent's internal plan storage at ~/.claude/plans/ (SKILL.md, Step 1).
Boundary markers: There are no explicit instructions or delimiters defined to separate user-provided plan content from the agent's own instructional logic during the transformation process.
Capability inventory: The generated qa-checklist.yaml is designed to be executed by a "QA checklist loop" (or the ralph-loop plugin) which has the capability to execute bash commands and perform extensive file system reads.
Sanitization: The procedure does not specify any validation, filtering, or sanitization of the plan's requirements before they are interpolated into executable shell commands.
Multi-step chains: The skill documentation notes that generated checklists for probabilistic features are handed off to another skill (/ai-done), which reuses the checklist, potentially propagating injected content further into the agent's workflow (SKILL.md, Procedure Header).
[COMMAND_EXECUTION]: The primary function of the skill is to generate shell commands for automated testing, build verification, and environment checks.
Evidence: Pre-built templates in references/desktop-app-checks.yaml and references/other-project-checks.yaml include example commands using curl, npx tsc, flutter analyze, grep, and node -e.
Functionality: It instructs the agent to produce "exact bash commands" for API status checks, build gate verification, and process health monitoring (SKILL.md, Step 4).

success-criteria