The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by generating implementation plans that include shell commands based on untrusted external specifications.
Ingestion points: Requirement documents and specifications provided as context in SKILL.md.
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the interpolation logic.
Capability inventory: The skill can write plan files to the local file system and initiate subagent review processes.
Sanitization: The workflow includes a mandatory "Plan Review Loop" where a subagent or human reviewer verifies the plan against the original specification to detect discrepancies or harmful instructions.
[NO_CODE]: No executable code, scripts, or binaries are shipped with this skill; it consists solely of instructions and prompt templates.
[COMMAND_EXECUTION]: The skill generates documentation containing example shell commands for development workflows (e.g., git commit, pytest). It does not execute these commands directly, but the generated content could be misused if the source specification is malicious.
[DATA_EXFILTRATION]: The skill records plan output to the docs/ directory within the workspace. No access to sensitive system files, environment variables, or private credentials was found.

writing-plans