The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves reading local project files (task_plan.md, findings.md, progress.md) and injecting their contents into the AI agent's context during various lifecycle events such as UserPromptSubmit and PreToolUse. This creates a significant attack surface for indirect prompt injection if external, untrusted data (e.g., from web searches or external APIs) is written to these files.
Ingestion points: The inject-plan.sh and inject-plan.py scripts read files from the project directory and the ~/.claude/projects/ directory (for the catchup feature).
Boundary markers: The skill employs ===BEGIN-PWF-DATA=== and ===END-PWF-DATA=== delimiters, which include nonces to prevent the agent from being misled by instruction-like text within the data.
Capability inventory: The skill utilizes file system tools (Read, Write, Edit, Glob, Grep) and shell execution via hooks.
Sanitization: The skill includes documentation warning users to treat external content as untrusted and specifically advises against writing web search results directly to task_plan.md.
[COMMAND_EXECUTION]: The skill extensively uses platform-level hooks (UserPromptSubmit, PreToolUse, PostToolUse, Stop, PreCompact) to execute shell commands. These commands perform complex logic to discover and run local scripts (skill-hook.sh, inject-plan.sh, inject-plan.py). This is a high-privilege mechanism designed for integration with developer-oriented AI agents like Claude Code.
[DYNAMIC_EXECUTION]: The skill uses Python and Shell scripts to handle metadata parsing and execution logic at runtime. For example, scripts/inject-plan.py uses the subprocess module to execute ledger-summary.sh, and scripts/skill-hook.sh uses Python to parse JSON metadata from the platform to manage session and agent identities.
[DATA_EXPOSURE]: The scripts/session-catchup.py script accesses the agent's local session history stored in ~/.claude/projects/. While it filters for sessions matching the current project to provide context, it involves reading sensitive transcript data from the user's home directory outside of the immediate project workspace.

planning-with-files-es