The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external implementation plans (Markdown files) to create task briefs for subagents. This creates a surface where a malicious plan file could contain instructions aimed at subverting the subagent's behavior.
Ingestion points: The scripts/task-brief script reads the PLAN_FILE to extract specific task descriptions.
Boundary markers: The subagent prompts (implementer-prompt.md, task-reviewer-prompt.md) use Markdown headers (e.g., ## Task Description) to isolate the external content, though this is not a cryptographic or robust security boundary.
Capability inventory: The skill possesses capabilities for filesystem writes (workspace creation), git operations (diffing, logging, committing), and the ability to dispatch further LLM subagents.
Sanitization: There is no evidence of sanitization or filtering of the plan content before it is interpolated into subagent prompts.
[COMMAND_EXECUTION]: The skill executes several local bash scripts to automate the development workflow. These scripts are bundled with the skill and are invoked with parameters that are generally handled securely through quoting.
Evidence: SKILL.md contains instructions to execute bash scripts/sdd-workspace, bash scripts/task-brief, and bash scripts/review-package. These scripts perform operations such as directory creation, git diffing, and text extraction using awk.

subagent-driven-development