The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads task definitions from external plan files and passes them directly to subagents with high-capability tools.
Ingestion points: The skill reads plan documents from .context/plans/<slug>.md in Step 1 and Step 2b of the workflow defined in SKILL.md.
Boundary markers: While the prompt construction in references/per-agent-template.md uses Markdown headers (e.g., ## Your task) to delineate the task, it lacks explicit instructions to the subagent to ignore any conflicting commands embedded within the ingested task text.
Capability inventory: The skill utilizes the Agent tool to spawn subagents which have the capability to perform various operations within the repository, potentially including file modifications and command execution.
Sanitization: No sanitization or validation is performed on the ingested task descriptions. In fact, SKILL.md explicitly mandates that the focus/task description must be copied verbatim without paraphrasing, which ensures that any malicious instructions injected into the plan document will be faithfully transmitted to the subagent.

wave-executor