The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill automatically injects contents from planning files like task_plan.md and findings.md into the agent's context. Since these files are intended to store data from external sources (web research, tool outputs), they serve as an ingestion point for potential indirect prompt injection attacks.\n
Ingestion points: task_plan.md, findings.md, progress.md, and session history files.\n
Boundary markers: The skill employs nonce-based delimiters and SHA-256 attestation (scripts/attest-plan.sh) to isolate and verify injected data.\n
Capability inventory: Includes file writing (scripts/phase-status.sh), hash calculation (scripts/attest-plan.sh), and local subprocess execution (scripts/inject-plan.py).\n
Sanitization: Uses SHA-256 attestation to require user approval for plan changes and performs JSON-escaping on synthesized ledger data.\n- [DYNAMIC_CONTEXT_INJECTION]: The skill's configuration uses hooks in SKILL.md to execute shell commands (scripts/skill-hook.sh) that dynamically inject environment-specific data into the agent's prompt during turn starts and tool operations.\n- [COMMAND_EXECUTION]: A significant number of shell and PowerShell scripts are included to manage project lifecycle, metadata, and task phases, which are executed locally through the agent platform's hook system.\n- [DATA_EXPOSURE]: The scripts/session-catchup.py script reads Claude Code session history from the user's home directory (~/.claude/projects/). While it restricts access to transcripts matching the current project directory, this involves processing sensitive local logs containing prior agent-user interactions.

planning-with-files