The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external specifications (referenced as a 'spec' or 'design doc') to generate implementation plans. Because these plans contain shell commands and code snippets intended for execution by other agent skills, a malicious specification could attempt to inject harmful instructions into the generated tasks.
Ingestion points: External specification files referenced in SKILL.md and plan-document-reviewer-prompt.md.
Boundary markers: Absent; the instructions do not define specific delimiters or 'ignore' instructions for the spec content.
Capability inventory: The skill defines tasks that include file creation, modification, and shell command execution (git, pytest).
Sanitization: Absent; there is no mention of validating or escaping content derived from the specification.
[DYNAMIC_EXECUTION]: The skill generates Python code snippets and shell commands (e.g., git commit, pytest) as part of the output implementation plan. While these are based on provided templates for development workflows, they are designed to be executed by downstream agents, creating a path for potentially malicious code generation if the input specification is compromised.

writing-plans