The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external data from .plan-review/feedback/plan-vN-feedback.json and incorporate it into agent plans. If an external process or attacker can write to these feedback files, they can inject malicious instructions that the agent is explicitly told to 'address'.
Ingestion points: The agent reads JSON feedback files from the .plan-review/feedback/ directory.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the feedback ingestion.
Capability inventory: The skill allows the agent to read/write files and execute approved plans (which may involve shell commands or file modifications).
Sanitization: No sanitization or validation of the feedback content is mentioned before it is merged into the revised plan.
[DYNAMIC_EXECUTION]: The skill instructs the agent to 'read [the approved plan] and execute the approved plan carefully'. This creates a dynamic execution pattern where the agent performs actions based on instructions stored in a Markdown file (approved-plan.md). Although there is a human-in-the-loop requirement (the user must approve the plan), the instruction directs the agent to execute arbitrary steps defined in data.
[COMMAND_EXECUTION]: The skill provides a specific shell command (vp dev) for the user to run to launch a reviewer interface. While this command is presented to the user rather than executed by the agent automatically, it includes environment variable injection (PLAN_REVIEW_DIR). Additionally, the execution of the 'approved plan' likely involves the agent running shell commands or using project tools.

refined-plan-mode