The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted requirement data from external URLs and local files to generate execution plans. A malicious document could attempt to influence the agent's behavior during the planning phase.
Ingestion points: The skill fetches content from external URLs provided by the user and reads local markdown files.
Boundary markers: While the skill uses a strict task template, it does not specify clear delimiters or instructions to ignore malicious directives embedded within the input requirements.
Capability inventory: The skill allows the agent to read project-level configuration (CLAUDE.md, AGENTS.md, openspec/config.yaml) and write new files to the docs/plans/ directory.
Sanitization: There is no evidence of explicit sanitization or filtering of the fetched external text.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to facilitate planning and architectural visualization.
Requirement Ingestion: Fetches proposal or requirement documents from remote URLs using a document-reading tool.
PlantUML Validation: The skill interacts with the well-known service https://www.plantuml.com/plantuml to validate diagram syntax and generate images. This is a standard architectural tool and does not indicate an exfiltration risk.

ss-plan