The Agent Skills Directory

[COMMAND_EXECUTION]: The skill integrates with external CLI tools from Google Gemini and OpenAI to facilitate plan reviews. These tools are executed via Bash commands during the workflow as defined in references/external-review.md.
[EXTERNAL_DOWNLOADS]: The skill performs web research using agent subagents to fetch information on technologies and best practices from external sources, as described in references/research-protocol.md.
[PROMPT_INJECTION]: The review instructions provided to external models request an 'unconstrained assessment,' which is a pattern often associated with attempts to bypass standard AI safety filters. This instruction appears in references/external-review.md.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided specification files and web research results, which is then incorporated into synthesized implementation plans and section files. This creates a potential surface for indirect prompt injection if the external data contains malicious instructions.
Ingestion points: User-provided markdown spec files and web research findings aggregated in the planning directory.
Boundary markers: No explicit boundary markers or 'ignore' instructions were found in the prompts used to process external data.
Capability inventory: The skill can execute shell commands, perform file system operations (read/write), and launch parallel subagent tasks.
Sanitization: No sanitization or validation logic for external content was identified in the workflow.
[METADATA_POISONING]: The skill's execution logic and documentation reference non-existent AI model versions, such as 'gpt-5.2' and 'gemini-3-pro-preview', which is deceptive. Additionally, there is a discrepancy between the stated author 'microck' and the repository 'softaworks' mentioned in the README.

gepetto