The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a 'filesystem as memory' pattern where the agent is instructed to fetch external data (via WebSearch or WebFetch) and record it in persistent files like findings.md and task_plan.md. The skill further mandates that the agent re-read these files before making major decisions to 'refresh goals.' This architecture creates a persistent injection surface where malicious instructions found on the web could be stored on disk and later influence the agent's behavior during a 're-orientation' phase.
Ingestion points: External data enters the context through WebFetch and WebSearch tools, which is then written to project files via Write and Edit tools.
Boundary markers: Absent. The provided templates (findings.md, task_plan.md) lack specific delimiters or instructions to treat stored research findings as untrusted data.
Capability inventory: The skill allows access to Bash, Write, Edit, and WebSearch tools.
Sanitization: Absent. The instructions encourage logging all discoveries and errors verbatim to build a comprehensive knowledge base.
[COMMAND_EXECUTION]: The skill utilizes automated shell commands through various lifecycle hooks to monitor task progress and verify completion.
Hooks evidence: The SKILL.md file defines PreToolUse and PostToolUse hooks that execute cat and echo commands. The Stop hook executes a local bash script (check-complete.sh) to verify phase completion.
Script execution: The skill includes scripts/init-session.sh and scripts/check-complete.sh, which perform file operations and string matching using grep to manage the planning state.

planning-with-files