The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements an "autonomous execution mode" that treats the initial user instruction as a "batch approval," effectively bypassing human-in-the-loop verification for individual sub-agent tasks and code commits.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests task files from the docs/plans/tasks/ directory and treats them as the "primary instruction source" for sub-agents without implementing sanitization or boundary markers.
Ingestion points: Task files located in docs/plans/tasks/ matching the pattern {plan-name}-task-*.md (as defined in SKILL.md).
Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands in the ingested data.
Capability inventory: The skill can spawn multiple sub-agents (task-executor, quality-fixer, etc.), execute git commit commands, and delete files from the local filesystem.
Sanitization: Absent; no escaping or validation of the task file content is performed before passing it to sub-agents.
[COMMAND_EXECUTION]: The skill autonomously performs filesystem and version control operations, including executing git commit and deleting task-related files in the docs/plans/tasks/ directory upon completion of the implementation cycle.

recipe-build