The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled plan artifacts (PLAN.md, index.md) and project rules as implementation instructions, which represents an attack surface for instructions embedded in data.
Ingestion points: Reads files defined in paths.plan, paths.plans, and paths.rules using the Read tool to determine implementation steps.
Boundary markers: The skill utilizes specific HTML comment tags such as  and  to identify metadata and plan modes, but it lacks comprehensive delimiters to isolate natural language instructions from potential code injection.
Capability inventory: Possesses significant capabilities including Bash for shell command execution, Write and Edit for filesystem modification, and TaskUpdate for workflow state management.
Sanitization: There is no explicit evidence of sanitization, escaping, or strict schema validation of the content read from plan artifacts before it is used to drive the implementation logic.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform administrative repository tasks and integrity checks.
Evidence: It executes git commands for branch management (e.g., git branch --show-current), status checks, and worktree operations. It also uses shasum -a 256 for file integrity validation and printenv to check for specific configuration environment variables like HANDOFF_MODE.
[DATA_EXFILTRATION]: The skill synchronizes task progress and plan content with an external coordinator using dedicated tools.
Evidence: When HANDOFF_MODE is active, the skill invokes mcp__handoff__handoff_push_plan and mcp__handoff__handoff_sync_status to transmit current plan content and status updates to the Handoff coordination service. This is a documented design choice for multi-session persistence and agent synchronization.

aif-implement