The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's context initialization script accesses and exports sensitive environment configuration.
The scripts/implement-context.sh script includes a load_dotenv function that targets the .env file at the repository root.
It parses every entry in the file and uses export to make these variables available in the shell environment, which can expose API keys, database credentials, and other secrets to the agent's context and any subprocesses it executes.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute instructions from an external plan file, creating an unmitigated injection surface.
Ingestion points: The agent is instructed in SKILL.md (Step 2) to read and follow the plan_file identified by the context script.
Boundary markers: The skill fails to use any delimiters, system-level warnings, or boundary markers to differentiate the untrusted plan content from its primary instructions.
Capability inventory: The skill possesses broad capabilities, including writing to the filesystem and executing commands via the Bash tool, which could be leveraged by a malicious plan to perform unauthorized actions.
Sanitization: There is no evidence of sanitization, validation, or filtering of the plan content before the agent begins implementing the steps described within it.
[COMMAND_EXECUTION]: The skill relies on an external, non-standard CLI dependency.
The script scripts/implement-context.sh invokes the mdtodo utility to manage task selection. The security and integrity of this tool are unverifiable as it is not a standard system component or a well-known package from a trusted registry.

pflow-task-implement