The Agent Skills Directory

[PROMPT_INJECTION]: The instructions are focused on structured data processing and do not attempt to bypass safety filters, extract system prompts, or override agent behavior. The skill explicitly mandates passing file paths rather than raw content to sub-agents, which acts as a safeguard against certain prompt injection vectors.
[DATA_EXFILTRATION]: The skill's scope is restricted to reading markdown plan files and writing a JSON output to the 'docs/' directory. There are no network calls, hardcoded credentials, or access to sensitive system paths (e.g., SSH keys or environment files).
[REMOTE_CODE_EXECUTION]: No remote code execution patterns or package installations were detected. The skill uses a sub-agent to parse text and map task dependencies, which is a standard platform capability.
[COMMAND_EXECUTION]: The skill uses file system tools (Glob and Write) for legitimate project management purposes. It does not execute arbitrary shell commands or use dangerous system utilities.
[PROMPT_INJECTION]: Although the skill processes untrusted data from plan files, it is designed for internal project orchestration.
Ingestion points: Reads content from docs/dev-plan.md, docs/frontend-plan.md, and docs/backend-plan.md into the agent context.
Boundary markers: Explicit delimiters for the ingested plan content are not defined in the sub-agent prompt.
Capability inventory: The spawned agent has the capability to write the docs/progress.json file using the Write tool.
Sanitization: No explicit sanitization of the input markdown text is performed before parsing.

complete-plan