The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, including direct user input ($ARGUMENTS) and returned values from various subagents (e.g., quality-fixer, task-executor, code-reviewer). This data is used to make workflow decisions and is mechanically extracted into prompts for subsequent agent calls. The lack of explicit boundary markers or sanitization logic in the instructions creates a vulnerability where malicious data from the codebase or subagent outputs could influence the orchestrator's behavior.
Ingestion points: User-provided arguments ($ARGUMENTS), subagent return results, and codebase files (via codebase-analyzer).
Boundary markers: None defined for prompt interpolation.
Capability inventory: File deletion, git commit operations, and subagent orchestration.
Sanitization: No escaping or validation of external content before interpolation.
[COMMAND_EXECUTION]: The skill instructs the agent to perform destructive file system operations, specifically deleting files matching the pattern docs/plans/tasks/{plan-name}-backend-task-*.md and docs/plans/tasks/{plan-name}-frontend-task-*.md. While this is part of a defined 'Final Cleanup' phase, it represents a pre-configured command execution capability on local files. It also involves an environment check for git commit capabilities to execute a per-task commit cycle.

recipe-fullstack-implement