The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates untrusted data from the local project environment into its decision-making process.
Ingestion points: The process defined in SKILL.md requires the agent to read the "current project state," including local files, documentation, and recent git commits, to understand the context.
Boundary markers: The instructions do not define clear delimiters or provide the agent with warnings to ignore potentially malicious instructions embedded within the files it reads.
Capability inventory: The skill has the ability to write new markdown files to the docs/plans/ directory and execute git commits to persist these changes.
Sanitization: There is no evidence of sanitization or filtering logic to prevent content from project files from overriding the agent's core instructions.

brainstorming