The Agent Skills Directory

[PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design, as it instructs the agent to read and follow instructional content from files located in the .plans/ directory of the repository.
Ingestion points: The agent is directed to read .plans/*.md files based on the current git branch name using grep and file reading tools during startup and reconciliation.
Boundary markers: There are no explicit instructions for the agent to distinguish between data and instructions within these plan files, nor are there delimiters to prevent the agent from following embedded malicious commands.
Capability inventory: The agent has the ability to execute git commands, perform file system operations, and invoke other logic/skills based on the plan's content.
Sanitization: The skill contains no logic to sanitize, filter, or validate the content of the plan files before the agent processes them as instructions.
[COMMAND_EXECUTION]: The skill relies on the execution of shell commands to automate the workflow, though these are limited to repository metadata and file management.
Evidence: Instructions include the use of git branch --show-current to identify work context, grep -l to locate plans, and git mv for archiving completed work.

rjv-work-plan