The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script located at ~/.claude/scripts/plan-manager.py using the Bash tool. It passes user-provided strings (plan names, titles, task numbers, and reasons) as command-line arguments to this script. While the script is intended to be deterministic, execution of local scripts with user-controlled arguments is a capability that should be monitored.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes and displays the contents of plan files which may contain untrusted instructions.
Ingestion points: Plan data is read from files in the plan/ directory and displayed via the plan-manager.py show command as described in Phase 2 of SKILL.md.
Boundary markers: Absent. The instructions do not define any boundary markers or delimiters to separate plan content from agent instructions, and explicitly direct the agent to "show complete output" and "never summarize".
Capability inventory: The skill uses the Bash tool to execute system commands and the Read tool to access files.
Sanitization: Absent. There is no evidence of sanitization, filtering, or validation of the plan content before it is processed by the agent.

plan-manager