The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in external data it ingests during the execution process.
Ingestion points: The skill reads from <plan-path>.tasks.json and Markdown plan files (Step 0 and Step 1).
Boundary markers: The skill relies on parsing json:metadata code fences to extract task details, but lacks instructions to sanitize or ignore instructions embedded within these data blocks.
Capability inventory: The agent has access to shell execution via verifyCommand, git operations, and native task management tools (TaskCreate, TaskUpdate).
Sanitization: There is no evidence of validation or filtering for the content of the task descriptions or verification commands before they are processed or executed.
[DYNAMIC_EXECUTION]: The skill performs dynamic command execution based on local file content.
Evidence: In Step 2.3 and 2.4, the skill instructions direct the agent to parse a verifyCommand from a JSON metadata block and execute it exactly as specified. This allows for arbitrary shell command execution if the underlying .tasks.json or plan file is modified by an untrusted source.
[COMMAND_EXECUTION]: The skill utilizes shell commands for workspace management.
Evidence: The skill executes git worktree list and uses the superpowers-extended-cc:using-git-worktrees sub-skill to manage development environments.

executing-plans