The Agent Skills Directory

[PROMPT_INJECTION]: The skill interpolates user-provided content from the $ARGUMENTS variable directly into its decision-making logic without the use of boundary markers or sanitization instructions. This makes the agent vulnerable to indirect prompt injection where a user or an external source could provide instructions that override the orchestrator's intended flow.
Ingestion points: The $ARGUMENTS variable in SKILL.md used for situation assessment.
Boundary markers: Absent. There are no delimiters (e.g., XML tags or code blocks) or explicit instructions to ignore embedded commands within the input.
Capability inventory: Access to the Bash tool (used for git operations and file deletion), the Agent tool (for sub-agent delegation), and task management tools (TaskCreate, TaskUpdate).
Sanitization: Absent. No logic is provided to validate or escape the input provided via $ARGUMENTS before it is processed by the agent.
[COMMAND_EXECUTION]: The skill instructs the agent to use the Bash tool for several operations, including git commits and the deletion of implementation task files in the docs/plans/tasks/ directory. Although these are intended features of the orchestration lifecycle, the combination of file deletion capabilities using patterns derived from path names and the aforementioned injection surface presents a risk of unintended file modification or deletion.

recipe-implement