The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to generate implementation plans, which are then used as instructions for downstream execution, creating an attack surface for indirect prompt injection.
Ingestion points: The instructions in SKILL.md require the agent to "Read live requirements and relevant comments" from repository trackers or external documents.
Boundary markers: The skill does not specify the use of delimiters or provide instructions to ignore potentially malicious embedded commands within the external requirements or comments.
Capability inventory: The skill produces an implementation contract that guides code generation and executes a local hashing script (plan-header.mjs) using the content of the issue body.
Sanitization: There are no requirements for sanitizing, escaping, or filtering the external content before it is processed or passed to the validation scripts.
[COMMAND_EXECUTION]: The skill invokes local shell commands to generate plan digests and verify readiness.
Evidence: In SKILL.md, the agent is instructed to use the executing-plans skill's scripts/plan-header.mjs digest command on the issue body and to run plan-header.mjs check to confirm plan freshness before publication.

writing-plans