The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of prioritized action plans (Mode A) or user-named chains (Mode B), which direct the agent's execution flow.\n
Ingestion points: Reads plan files from _pm-skills/plans/ and accepts chain expressions via $ARGUMENTS.\n
Boundary markers: Uses specific anchors like #### To execute and **Prompt:** defined in references/PARSE-CONTRACT.md to delimit instructions.\n
Capability inventory: The orchestrator can write files to the disk, execute Bash commands via sub-processes, and delegate tasks to other agents using the Skill tool.\n
Sanitization: No explicit sanitization, escaping, or "ignore embedded instructions" warnings are applied to the content parsed from the plan artifacts before execution.\n- [COMMAND_EXECUTION]: The orchestrator explicitly checks for and executes Bash commands required by downstream skills as part of its operational loop.\n
Evidence: SKILL.md instructions specify verifying the client can "run any Bash a downstream skill needs."\n- [DYNAMIC_EXECUTION]: The skill implements a "reference + execute inline" pattern where it reads the SKILL.md of downstream skills at runtime and executes their logic inline within the current session.\n
Evidence: SKILL.md step 5 instructs the agent to "read the downstream skill's SKILL.md and execute its method inline in this window."

utility-pm-workflow-orchestrator