The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for environment resolution and metadata retrieval. Specifically, it provides a shell snippet in SKILL.md to resolve the PLUGIN_ROOT directory and utilizes git commands such as git config user.name, git remote, and git branch --show-current to automatically populate fields in the generated documentation.
[INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it processes data from external, potentially untrusted project files and third-party tracker descriptions.
Ingestion points: The skill reads requirements and descriptions from README.md files in user story directories, bug dossiers from other system components, and work item data from Azure DevOps.
Boundary markers: The skill uses structured markdown templates and specific HTML comment anchors (e.g., ) to delimit sections, but these do not prevent the agent from following instructions embedded within the processed text.
Capability inventory: The skill is capable of reading and writing to the local file system, executing local shell commands, and making network requests via MCP tools for Azure DevOps integration.
Sanitization: There is no evidence of explicit sanitization or instruction-stripping for external content before it is interpolated into the planning documents.

work-plan