The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests untrusted implementation plans from the chat interface or local files and passes them to multiple specialized sub-agents for analysis. This creates a surface for indirect prompt injection, where instructions embedded within a plan could attempt to influence the sub-agents' verdicts or the orchestrator's consolidation logic.
Ingestion points: Plan content is ingested from user messages in the chat or from Markdown files stored in the .cursor/plans/ directory, as specified in SKILL.md.
Boundary markers: The skill employs explicit delimiters (--- PLAN --- and --- FIN PLAN ---) to wrap untrusted content when delegating tasks to sub-agents, which helps mitigate instruction confusion.
Capability inventory: The orchestrator launches multiple sub-agents (e.g., plan-craftsmanship, plan-architecture, plan-security) in parallel, reads their scoring and verdicts, and generates a final consolidated report and a revised plan based on that feedback.
Sanitization: The skill does not implement explicit sanitization, filtering, or validation of the input plan content before it is processed by the agent council.

plan-council