The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is instructed to run shell commands derived from external workspace files for setup and verification purposes.
Evidence: Section 3 of the instructions directs the agent to "Run low-impact setup (dependency installs, local env vars) directly" and to "Run the task's verification commands and confirm the acceptance criteria".
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by consuming and authoritatively following instructions from external markdown files.
Ingestion points: The skill reads implementation details from docs/plans/*/plan.md and individual task files in the tasks/ directory.
Boundary markers: There are no explicit boundary markers or instructions to the agent to treat plan content as untrusted; it is explicitly instructed to "follow it exactly" and that "the plan was written so an agent could execute it without guessing".
Capability inventory: The agent has the capability to perform file writes, shell command execution (setup and verification steps), git operations (commit, branch, push), and dependency management.
Sanitization: The skill lacks mechanisms to sanitize or validate the commands or code implementation steps provided in the plan files before execution.

execute-plan