The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill reads external project data, including task descriptions, notes, and various markdown plan files, and interpolates their contents directly into the prompts for sub-agents ('potenlab-small-coder' and 'potenlab-high-coder'). This design creates a surface where malicious instructions hidden in the project documentation could influence the sub-agents' behavior.
Ingestion points: The skill reads 'progress.json' (Step 2.1) and instructs sub-agents to read 'docs/dev-plan.md', 'docs/frontend-plan.md', 'docs/backend-plan.md', 'docs/ui-ux-plan.md', and 'docs/progress.json' (Step 4.1d).
Boundary markers: Absent. Information from variables like '{task.notes}', '{task.verify}', and the content of documentation files are placed directly into sub-agent prompts without delimiters, boundary markers, or specific instructions to ignore embedded commands.
Capability inventory: The orchestrator writes to the local filesystem ('progress.json'). The sub-agents ('potenlab-small-coder' and 'potenlab-high-coder') are tasked with implementing code, which inherently requires file system writes and potential command execution capabilities.
Sanitization: No evidence of validation, escaping, or sanitization is present for the content extracted from the documentation files or JSON fields before they are used to construct prompts for other agents.

execute-phase