The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute shell commands as a core part of its verification process.
Evidence: The VERIFY state in SKILL.md explicitly instructs the agent to "Run all verification commands" specified in the requirements file.
[DYNAMIC_EXECUTION]: The skill dynamically sources and executes executable content from plain text files within the user's project directory.
Evidence: The agent is directed to read the "Verification section from requirements.md" and execute the resulting strings as shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill's logic and high-privilege actions (command execution) are driven by untrusted data ingested from the project directory.
Ingestion points: The agent reads from .claude/tasks.md, .claude/requirements.md, and .claude/session.md to determine its next actions and the commands to run.
Boundary markers: There are no instructions to differentiate between user data and instructions, nor are there delimiters to prevent embedded instructions from taking control of the agent.
Capability inventory: The skill has access to shell command execution (via the VERIFY state) and file system write access for task updates.
Sanitization: The skill lacks any mechanism to validate or sanitize the commands extracted from requirements.md before they are executed in the shell.
[PROMPT_INJECTION]: The skill includes instructions that attempt to manipulate the agent's internal configuration to ensure strict adherence to the skill's workflow.
Evidence: README.md contains instructions suggesting the agent should exit its built-in "plan mode" to become "more compliant" with the skill's state machine.
[METADATA_POISONING]: The skill uses its metadata fields to inject functional instructions into the agent's context.
Evidence: The description field in the SKILL.md frontmatter contains imperative instructions like "FOLLOW THE STATE MACHINE" and "NEVER use TodoWrite" rather than a purely descriptive summary.

lightweight-task-workflow