The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user responses during the interview phase and from the codebase during exploration. This data is used to generate a structured implementation plan in the docs/plans/ directory. If the input data contains malicious instructions, they could be incorporated into the plan and subsequently followed during the auto-start implementation phase.
Ingestion points: User input gathered via the ask_user tool (Phase 1) and codebase content processed during the 'Codebase Exploration' (Phase 2).
Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to disregard or sanitize embedded instructions within the ingested data.
Capability inventory: The skill has the ability to write files to the local filesystem (docs/plans/) and is instructed to automatically initiate code implementation immediately after plan approval.
Sanitization: There is no evidence of sanitization, validation, or escaping of the external content before it is interpolated into the generated plan files.

plan-interview