The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by reading user-controlled project files and injecting their content into the model's context via platform hooks.
Ingestion points: The skill reads task_plan.md, findings.md, progress.md, and structured ledger files from the project's .planning/ directory. It can also ingest agent session transcripts from ~/.claude/projects/ or ~/.codex/sessions/ if the user explicitly triggers the catchup feature.
Boundary markers: Injected content is enclosed in ===BEGIN-PWF-DATA=== and ===END-PWF-DATA=== fences using unique nonces and SHA-256 digests. It also includes explicit system warnings for the model to treat the content as untrusted data only.
Capability inventory: The skill possesses the ability to read and write files within the project directory and execute local shell and Python scripts for state management.
Sanitization: The skill uses strict path canonicalization to ensure all file operations remain within the verified project root (containment) and employs SHA-256 hashing to detect unauthorized modifications to the plan (attestation).
[COMMAND_EXECUTION]: The skill uses platform lifecycle hooks (such as UserPromptSubmit and PreToolUse) to execute local shell scripts (skill-hook.sh, inject-plan.sh) and Python scripts (inject-plan.py). These scripts are packaged with the skill and are used to summarize planning state and inject it into the model context.
[SAFE]: The skill demonstrates high security awareness by implementing a multi-layered defense-in-depth approach. This includes atomic file operations, robust path validation on both Windows and POSIX systems to prevent symbolic link attacks, and integrity verification to prevent the model from being fed tampered instructions.

planning-with-files-ar