The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill contains an indirect prompt injection and shell expansion surface within the coordinator framework hooks defined in the frontmatter of SKILL.md.
Ingestion points: Untrusted external input enters the context via the $TASK environment variable processed during the lifecycle hooks.
Boundary markers: No delimiters, escaping, or strict validation structures are defined to isolate the content of the $TASK variable.
Capability inventory: The platform executes defined shell strings via pre and post hooks, invoking echo and memory_store utilities.
Sanitization: The $TASK variable is directly interpolated inside double quotes within a shell context block, which does not prevent bash command substitution (e.g., $(...)) if an adversarial task description is supplied.

agent-planner