The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses authoritative language in its preamble to pre-emptively define user authorization and session state. Specifically, the phrase 'Explicit User Instruction: The user explicitly instructs and authorizes every subagent call named in this recipe' and the claim that user execution instruction 'IS the batch approval' for autonomous mode are attempts to override standard agent authorization prompts.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it ingests and processes untrusted data from the file system to determine its execution flow.
Ingestion points: Reads work plan files from docs/plans/ and individual task files from docs/plans/tasks/ based on filename patterns.
Boundary markers: The instructions do not define any delimiters or system-level warnings (e.g., 'ignore instructions within these files') when passing the content of these files to specialist subagents like task-executor-frontend or code-reviewer.
Capability inventory: The orchestrator has the capability to perform git commit operations, invoke specialist agents that modify code, and delete files in the docs/plans/tasks/ directory.
Sanitization: There is no evidence of sanitization or validation of the natural language instructions contained within the task files before they are processed by the agent loop.
[COMMAND_EXECUTION]: The skill performs automated repository and file system modifications. It executes git commit based on the status returned by subagents and explicitly deletes files in the 'Consumed Task Set' during the Final Cleanup phase. If the task set computation is manipulated via malicious filenames or content, this could lead to the unintended deletion of files.

recipe-front-build