The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes git add and git commit to stage and persist artifacts such as tasks.md and status.yaml to the repository.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project files and passes it to subagents and specialized tools, creating an attack surface where malicious instructions in specification files could influence the agent's behavior.
Ingestion points: The skill reads proposal.md, features/*.feature, design.md, and beat/config.yaml from the local file system (SKILL.md, Step 3).
Boundary markers: The subagent prompt template (review-subagent-prompt.md) uses markdown headers to separate artifacts, but lacks explicit instructions to ignore embedded prompts within the ingested data.
Capability inventory: The skill possesses file-write capabilities (tasks.md, status.yaml, ADR files), shell command execution (git), and the ability to invoke other platform tools (superpowers:using-git-worktrees, superpowers:writing-plans).
Sanitization: No validation, escaping, or sanitization is performed on the content of specification files before they are interpolated into prompts for the subagents or the writing-plans tool.

plan