The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill is designed to ingest and analyze implementation plans (plan.md) which may contain untrusted data. If a plan contains instructions specifically crafted to influence the subagents' behavior, there is a possibility of the agent following those embedded instructions.
Ingestion points: Reads implementation plans from plan.md or user-specified files in the workflow scoping step.
Boundary markers: The instructions do not explicitly define delimiters or specific "ignore embedded instructions" warnings when processing the plan content.
Capability inventory: The skill has capabilities to read, write, and revise files in the local environment, as well as perform web searches and execute development commands.
Sanitization: No explicit sanitization or filtering of the plan content is described before it is processed by subagents.
[Command Execution Capabilities]: The skill instructions suggest that subagents should "run existing tests or check lint/compile errors" to validate plan assumptions. This involves executing code within the local development environment.
Context: This is a standard and expected capability for a developer productivity tool focused on implementation planning.
Potential Consideration: While functional, it represents a capability that could be targeted if an indirect prompt injection were successful.

review-plan