The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves automatically reading project files (task_plan.md, findings.md, progress.md) and injecting their contents into the agent's context during various lifecycle events (UserPromptSubmit, PreToolUse). This creates a vulnerability surface where instructions embedded in these files (e.g., from an untrusted tool output or a git checkout) are repeatedly fed back into the model's instructions.
Ingestion points: The files task_plan.md, findings.md, and progress.md are read by scripts/inject-plan.sh and scripts/inject-plan.py and formatted for prompt injection.
Boundary markers: The skill uses ===BEGIN-PWF-DATA=== and ===END-PWF-DATA=== delimiters accompanied by a SHA-256 digest and a per-payload nonce to mitigate delimiter-spoofing attacks.
Capability inventory: The skill is configured with allowed-tools: "Read Write Edit Bash Glob Grep" and executes multiple bundled shell, PowerShell, and Python scripts via hooks.
Sanitization: The skill includes explicit warnings in SKILL.md and the injected prompt context instructing the agent to treat the data as untrusted and to ignore any instruction-like text within the plan data.
[COMMAND_EXECUTION]: The skill relies on a suite of scripts (.sh, .ps1, .py) to manage planning state, verify file integrity, and summarize activity ledgers. These scripts use subprocess.run (Python) and standard shell execution to perform local operations. Static analysis flagged subprocess.run in scripts/inject-plan.py, but review shows it executes a bundled script (ledger-summary.sh) using a resolved path.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md frontmatter defines multiple hooks (UserPromptSubmit, PreToolUse, etc.) that execute shell commands at runtime to discover and invoke the skill's logic. This dynamically replaces hook placeholders with the output of the local scripts, effectively injecting calculated context into the agent's interaction loop.
[DATA_EXPOSURE]: The script scripts/session-catchup.py accesses internal agent data stored in ~/.claude/projects/ and ~/.codex/sessions/ to facilitate task resumption. While it includes privacy-preserving measures like hashing sensitive metadata into opaque labels and requiring explicit user flags (--replay) to output transcript excerpts, it demonstrates the ability to read information outside the immediate project directory.

planning-with-files-de