The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository files, plan files, and command outputs, creating a surface for indirect prompt injection.
Ingestion points: The agent reads repository source files, plan text, and command/test output during execution (SKILL.md, Security Model section).
Boundary markers: The skill includes a dedicated 'Security Model' section that explicitly defines 'Untrusted input' and instructs the agent that instruction-shaped content found in files or logs is evidence, not a directive.
Capability inventory: The skill is authorized to edit files and execute shell commands such as tests, linting, and build tools (SKILL.md, Section 12).
Sanitization: The skill relies on the agent's adherence to the 'Security Model' instructions to distinguish between data and instructions, rather than programmatic sanitization.
[COMMAND_EXECUTION]: The skill executes project-specific shell commands for verification and status checks.
Evidence: Instructions to run git status --porcelain, git diff --name-only HEAD, and project-specific test commands like npm run test:unit (SKILL.md, Sections 8 and 12).
Constraint: Command execution is constrained to the task's declared scope and risk-proportional verification depths (Low, Medium, High).

inline-plan-dev