The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted implementation plans and external documents which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill resolves plans from user messages, named files, and all normative documents declared within plans, as well as repository code, tests, and history as described in SKILL.md.
Boundary markers: The skill provides logical instructions to 'Distinguish confirmed repository facts' and 'Verify every proposed blocker', which acts as a cognitive delimiter, but it lacks formal technical markers or specific 'ignore embedded instructions' warnings for external content.
Capability inventory: According to SKILL.md, the agent has capabilities to read repository files and can update specific files like spec.md or prd.json if explicitly requested by the user.
Sanitization: No specific sanitization, filtering, or escaping mechanisms for external inputs are defined in the instructions.

workflows-plan-review