The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources within the repository, which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill reads ROADMAP.md, PLAN.md, AGENTS.md, and files within the plans/, tasks/, and goals/ directories (e.g., evals/fixtures/planning-review/plans/team-invitations.md). It also ingests external signals such as git status, recent commits, and pull request metadata.
Boundary markers: The skill relies on specific Markdown section headers (e.g., ## Outcome, ## Current state, ## Next action) and schema validation for goal files. It explicitly instructs the agent to "reconcile it with direct instructions and repository evidence before relying on it" and to "fail closed" if goal state is malformed.
Capability inventory: The skill is authorized to perform file writes (updating roadmaps and plans) and recommends implementation actions. Fixture instructions (e.g., in evals/fixtures/roadmap-drift/AGENTS.md) suggest the agent may run local validation tools like npm test based on repository state.
Sanitization: While the skill emphasizes verifying claims against implementation evidence, it lacks explicit sanitization or escaping mechanisms for the natural language content it interpolates from these untrusted files into its decision-making process.

progress