The Agent Skills Directory

[COMMAND_EXECUTION]: Requirement 4 ("Verification already run") instructs the agent to execute shell commands specified in the plan against the local filesystem to prove they work.
Evidence: SKILL.md contains the instruction: "Run every one [verification command] against the current tree before shipping the plan — an unrun command measures its own phrasing."
[REMOTE_CODE_EXECUTION]: Because the commands executed in Requirement 4 are derived from potentially untrusted external inputs (like spec.md or brief.md), an attacker could inject malicious shell commands into these source files that the agent will then execute during the planning phase.
Evidence: The skill documentation notes that "an installed plan-writing skill writes it" and the source material is "spec.md in the run directory... With none, brief.md or the discussion so far."
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data to generate the plan and perform automated checks without explicit sanitization or boundary markers.
Ingestion points: reads spec.md, brief.md, and the conversation history from the run directory.
Boundary markers: none found in the instructions for separating untrusted spec content from agent instructions.
Capability inventory: performs shell command execution (Requirement 4) and subagent invocation (Requirement 6).
Sanitization: none; the agent is instructed to "apply the requirements to the file in place" or "write the plan yourself to the same bar."

generate-plan