The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads and processes implementation plans (docs/plans/*.md) and referenced source code which are considered untrusted data.
Ingestion points: Plan files located in docs/plans/ and any files referenced within those plans.
Boundary markers: No specific delimiters or instructions are provided to the agent to treat external file content as data rather than instructions.
Capability inventory: The skill has the ability to read and write files, execute grep commands, and invoke other system skills.
Sanitization: There is no evidence of validation or sanitization of the ingested content.
[COMMAND_EXECUTION]: The skill uses the grep tool to analyze the codebase for potential logic duplication. This command is executed locally to support the skill's primary review function.

plan-challenger