The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently possesses an attack surface for indirect prompt injection because it autonomously reads and fact-checks workspace files (Phase 1) using tools like grep_search and view_file. A malicious file in the workspace could attempt to influence the agent's planning process. However, the workflow is designed to be resilient to this by enforcing a mandatory readiness gate in Phase 2.
Ingestion points: The skill utilizes grep_search, view_file, list_dir, code_search, and moma_search to ingest content from the current project environment.
Boundary markers: The agent is instructed to transform its findings into a structured summary (Goals, Non-Goals, Settled Decisions, Execution Plan) which acts as a clear boundary for user review.
Capability inventory: The skill restricts all mutating commands (file writes, branch creation) until Phase 3, after explicit approval is received via the ask_question tool.
Sanitization: The risk is mitigated by the 'human-in-the-loop' requirement; the agent cannot proceed to execution without a user explicitly reviewing the plan and selecting a 'proceed' option.

clarify-confirm-continue