The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting Goal and acceptance criteria from external plan files (docs/plans/**) and interpolating them into a sub-agent prompt. This is mitigated through several layers of defense:
Boundary Markers: The skill uses a structured XML payload (e.g., <task>, <constraints>, <output_contract>) to delimit untrusted content from system instructions.
Sanitization/Validation: It mandates a 'preflight gate' that checks the environment, CLI versions, and repository state before execution.
Human-in-the-loop: Any escalation of the sub-agent's sandbox (e.g., enabling network access via --dangerously-bypass-approvals-and-sandbox) requires explicit, one-time manual confirmation from the user.
[COMMAND_EXECUTION]: The skill uses the git and codex CLI tools for its core functionality. Execution is restricted to local operations within the repository root, and sensitive actions like git push are explicitly forbidden to prevent unauthorized remote changes.

handover