The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection, as it is designed to ingest user input and store it as executable configuration for downstream tasks.
Ingestion points: The skill ingests untrusted data from the user via the AskUserQuestion tool and from existing task descriptions via TaskGet (SKILL.md).
Boundary markers: Data is stored within json:metadata Markdown code fences. No specific "ignore embedded instructions" warnings are included in the generated metadata.
Capability inventory: The skill has file-write capabilities via TaskUpdate and modifications to .tasks.json (SKILL.md). It does not perform shell execution or network operations itself; these are deferred to the executing-plans skill.
Sanitization: No technical sanitization (escaping/filtering) is performed on user input. However, the instructions include a manual validation step where the agent is told to "push back" on vague or non-concrete responses.
[SAFE]: No malicious patterns, such as obfuscated code, unauthorized data exfiltration, or privilege escalation, were detected. The skill functions strictly as a configuration utility as described in its documentation.

specifying-gates