The Agent Skills Directory

[SAFE]: The skill operates entirely within the local project environment, targeting specific documentation (docs/design/) and plan (docs/plans/) directories using standard tools like Git.
[SAFE]: A robust human-in-the-loop security model is implemented through a mandatory confirmation step (Step 4) that prevents any automated modifications or fixes from occurring without explicit user approval.
[SAFE]: Sub-agent spawning follows the principle of least privilege by using fork_turns="none", which isolates sub-agents from the parent session's history and limits their context to the specific task provided.
[PROMPT_INJECTION]: The skill processes untrusted external data (Design Docs and implementation code) which presents a surface for indirect prompt injection. 1. Ingestion points: $ARGUMENTS input and project files in docs/design/ and implementation directories. 2. Boundary markers: Instructions rely on structured JSON outputs from sub-agents to maintain data integrity. 3. Capability inventory: spawn_agent calls and file write/delete operations in the docs/plans/tasks/ directory. 4. Sanitization: Not explicitly defined in orchestrator instructions, though the human confirmation step serves as the primary mitigation.

recipe-review