The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process implementation plans which are untrusted external data sources, creating a surface for indirect prompt injection.
Ingestion points: In Step 1 of SKILL.md, the agent discovers plans via direct user input or by reading external file paths.
Boundary markers: The instructions do not specify the use of clear delimiters or explicit instructions for the agent to disregard instructions embedded within the plans being reviewed.
Capability inventory: The agent possesses significant capabilities, including the ability to perform a broad scan of the codebase (Step 2) and the ability to generate and apply file modifications via unified diffs (Step 8).
Sanitization: There are no mechanisms described for sanitizing or filtering instructions contained within the external plan content.
[COMMAND_EXECUTION]: The skill's instructions and reference files (specifically references/tdd-patterns.md) provide numerous examples of shell commands, such as npm test, git commit, and pytest. While these are intended as templates for the user or validation checks, an adversarial plan could attempt to inject malicious shell commands that a less cautious agent might execute during the validation process.
[OBFUSCATION]: The file validate-plan.skill is a binary ZIP archive. Analysis of the archive contents confirms it is a standard distribution package containing the skill's source files (SKILL.md, references/, etc.). While binary files are generally treated with caution, this specific file appears to be a legitimate artifact of the skill packaging process and does not contain hidden or malicious payloads.

validate-plan