The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input via the $ARGUMENTS placeholder within <feature_description> tags. This content is subsequently used as a prompt for several specialized subagents (e.g., repo-research-analyst, best-practices-researcher). A malicious input could attempt to manipulate the reasoning or instructions of these subagents.
Ingestion points: The feature_description input in SKILL.md.
Boundary markers: The skill utilizes <feature_description> tags to delimit untrusted input.
Capability inventory: The skill accesses the file system (reading/writing plans in docs/plans/), launches multiple subagents for research, and interacts with a user-question tool.
Sanitization: No explicit sanitization or validation of the input content is performed before interpolation into subagent prompts.
[COMMAND_EXECUTION]: The skill executes shell commands (ls -la) to locate existing brainstorm and specification documents in the repository. This is a functional requirement for its task discovery phase and is restricted to the docs/plans/ directory.

workflows-plan