The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary mechanism involves the agent reading and following "ExecPlans"—markdown files containing detailed implementation steps. The instructions in references/execplan-guide.md direct the agent to follow these plans "to the letter," creating a vulnerability surface where a malicious plan could override intended behavior.
Ingestion points: Markdown files located in the plans/ directory or provided by the user (e.g., 0001-title-of-the-plan.md).
Boundary markers: While the guide defines a strict markdown format and a skeleton, it lacks explicit instructions to validate the plan's contents or treat them as untrusted instructions.
Capability inventory: The agent is authorized to list files, read files, search, run the project, and run tests as part of the plan execution.
Sanitization: No sanitization or safety verification process is defined for the content of the plans before execution.
[PROMPT_INJECTION]: The guide in references/execplan-guide.md contains instructions that reduce human-in-the-loop oversight. It explicitly tells the agent to "not prompt the user for 'next steps'" and to "resolve ambiguities autonomously." This autonomous posture, combined with the instruction to "simply proceed to the next milestone," significantly limits the user's ability to intervene or review actions during the implementation of a complex plan.

execplan