The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from project files and remote pull requests which presents a potential injection surface. \n * Ingestion points: The skill reads roadmap markdown files under the docs/ directory, checks roadmap-state.json files, and fetches pull request data using gh pr list and git show. In a collaborative environment, this data can be controlled by external contributors. \n * Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious embedded instructions within the ingested roadmap text. \n * Capability inventory: The skill possesses significant capabilities, including writing files to the local system, executing Git repository management commands, and invoking other specialized agent skills like writing-plans and brainstorming. \n * Sanitization: No sanitization, escaping, or filtering of the external content is described before it is parsed or displayed. \n * Mitigation: The risk is lowered by the skill's enforcement of a 'Plan Mode' loop (as described in references/writing.md), which requires human approval of generated plans via the Plannotator tool before any implementation occurs. \n- [COMMAND_EXECUTION]: The skill relies on several shell commands to manage repository state, including git fetch, git merge, git sparse-checkout, and gh pr list. While these are standard tools for repository management, they interact with data from remote sources.

roadmap