The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md and SKILL.md.dspy-optimized files contain instructions that direct the agent to execute a shell command using the Bash tool. The user-provided task argument is interpolated directly into this command string inside single quotes. This pattern is vulnerable to shell command injection if the user input contains single quotes (e.g., "' ; malicious_command ; '"), allowing for arbitrary code execution on the host machine.
Evidence (SKILL.md): command="sagaflow launch deep-plan --arg task='<TASK>' --arg max_iter=<N> --arg sdd_dir='<SDD_DIR>' --arg spec='<SPEC_FILE>' --await".
Evidence (SKILL.md.dspy-optimized): command="sagaflow launch deep-plan --arg task='<TASK>' --arg max_iter=<N> --await".
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data (the task description) and processes it through multiple autonomous subagents (Planner, Architect, Critic). This creates an attack surface where malicious instructions embedded in a task could potentially influence the planning loop's behavior or outcomes.
Ingestion points: task argument defined in SKILL.md and SKILL.md.dspy-optimized.
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are used when interpolating the task content into subagent prompts in workflow.py.
Capability inventory: The DeepPlanWorkflow uses spawn_subagent, write_artifact, emit_finding, and deliver_artifact_to_slack across its implementation.
Sanitization: No explicit sanitization or escaping of the task content is performed before it is passed to the subagent prompts in workflow.py.

deep-plan