The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to construct shell commands using the Bash tool that incorporate unsanitized user input. Placeholders such as NAME, TASK_NUM, and reason are used directly in commands like python3 ~/.claude/scripts/plan-manager.py create NAME and python3 ~/.claude/scripts/plan-manager.py abandon NAME --reason "reason". Without explicit instructions to sanitize or escape these variables, a malicious user could provide input containing shell metacharacters (e.g., semicolons, pipes, or backticks) to execute arbitrary commands on the host system.\n- [REMOTE_CODE_EXECUTION]: The skill has a hard dependency on an external, unverifiable script located at ~/.claude/scripts/plan-manager.py. All management operations flow through this script, which is not provided in the skill package, making its behavior impossible to audit for security vulnerabilities or malicious intent.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted user data and using it to drive powerful capabilities. \n
Ingestion points: User-supplied values for NAME, TASK_NUM, and reason within SKILL.md.\n
Boundary markers: None (the skill lacks delimiters or instructions to ignore instructions embedded in the user-provided data).\n
Capability inventory: Execution of shell commands via the Bash tool.\n
Sanitization: None (there is no logic to validate or clean the input before it is used in a shell context).

plans