The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an 'auto' mode that explicitly bypasses human review gates (Review Gates 1-4) in the workflow. This mode can be triggered by keywords in natural language input such as 'trust me', 'auto', or 'yolo', allowing for potential instruction override of safety protocols and skipping human-in-the-loop checkpoints.
[PROMPT_INJECTION]: The skill possesses a significant indirect prompt injection surface as it reads and executes tasks based on external, potentially untrusted plan files.
Ingestion points: Workflow steps in 'references/workflow-steps.md' ingest data from user natural language and files matching './plans/', 'plan.md', and 'phase-.md'.
Boundary markers: No delimited boundaries or 'ignore embedded instructions' warnings are used when processing the content of external plan files.
Capability inventory: Uses the 'Task' tool to spawn subagents with high-impact capabilities, including code implementation ('fullstack-developer'), testing ('tester'), and git repository operations ('git-manager').
Sanitization: There is no evidence of input sanitization or validation of the plan files' content before the agent executes the tasks described within them.
[COMMAND_EXECUTION]: The workflow orchestrates broad file system modifications and code execution by delegating work to subagents. While mediated by subagents, the ability to automate these high-privilege actions (like git commits and full-stack implementation) without mandatory approval in 'auto' mode represents a high-impact capability surface.

cook