The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The provided scripts plan-context.sh and plan-save.sh both contain logic to automatically load environment variables from a .env file located at the project root.
Evidence: The load_dotenv function in both bash scripts specifically targets $ROOT_DIR/.env, parses its content, and exports the key-value pairs to the environment.
Risk: .env files are frequently used to store sensitive information such as API keys, database credentials, and private tokens. Reading this file at runtime exposes these secrets to the script's execution environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process task information from an external todo.md file (via the mdtodo tool), which presents a surface for indirect prompt injection.
Ingestion points: plan-context.sh captures output from mdtodo current and mdtodo list (specifically task titles and statuses) to populate the agent's context for the current_task.
Boundary markers: The instructions in SKILL.md do not provide the agent with specific delimiters or guidance on how to safely handle potentially malicious instructions embedded within the retrieved task content.
Capability inventory: The skill is capable of writing files via plan-save.sh and executing bash scripts, which could be abused if an injected instruction is followed.
Sanitization: There is no evidence of content sanitization or validation performed on the task data before it is processed by the AI agent.

pflow-task-plan