The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses lifecycle hooks (UserPromptSubmit, PreToolUse, PostToolUse, Stop, PreCompact) to execute local shell and Python scripts for plan management and injection. It also uses subprocess.run to coordinate between utility scripts like ledger-summary.sh. These executions are scoped to the local environment and sibling script paths.
[INDIRECT_PROMPT_INJECTION]: The skill ingests content from local planning files (task_plan.md, findings.md, progress.md) and platform-internal session transcripts. This creates an attack surface where maliciously crafted data in the file system could influence agent behavior.
Ingestion points: Planning Markdown files in the project root or .planning/ directory, and Claude session history located in ~/.claude/projects/.
Boundary markers: Injected data is strictly framed using ===BEGIN-PWF-DATA ... === delimiters accompanied by SHA-256 derived nonces and warnings to the model to treat the content as data only.
Capability inventory: The skill allows access to Bash, Write, Edit, Read, Glob, and Grep tools.
Sanitization: Implements strict byte limits (e.g., PLAN_LIMIT, PROGRESS_LIMIT), uses hashing for session and project labels to avoid leaking raw IDs, and strips control characters during JSON serialization.
[PRIVILEGE_ESCALATION]: The attest-plan.ps1 script utilizes Add-Type to access Windows kernel32.dll for low-level file operations. This is used to ensure safe file handle management and prevent race conditions or symlink attacks, rather than for unauthorized privilege gain.

planning-with-files-zht