The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines specific 'Override prefixes' (e.g., 'must do:', 'exactly:') that explicitly instruct the agent to bypass confirmation prompts and review processes, treating the command as having a '--force' flag. This pattern removes intended safety layers between the user and the underlying execution scripts.
[DYNAMIC_EXECUTION]: The 3-stage routing pipeline dynamically constructs shell command strings by interpolating user-provided targets and flags (e.g., 'run '). The instructions lack any requirement for the agent to sanitize or escape these arguments before they are passed to the Bash tool, creating a risk for command injection if shell metacharacters are included in the input.
[INDIRECT_PROMPT_INJECTION]: • Ingestion points: The skill ingests raw strings from the user via explicit commands and a bare-word router hook that captures the start of messages. • Boundary markers: There are no defined delimiters or specific instructions to ignore instructions embedded within the user-supplied task descriptions or flags. • Capability inventory: The skill has high-privilege access to shell execution (Bash) and file system modification (Write, Edit, Read) to manage plan data. • Sanitization: No validation, filtering, or escaping logic is prescribed for processing untrusted data before its use in script execution or node file updates.

plan-orchestrator