The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes implementation plan files that are extracted into task briefs for subagents. This creates a surface for indirect prompt injection if the plan files contain malicious instructions.
Ingestion points: The scripts/task-brief script reads and extracts text from user-provided markdown plan files.
Boundary markers: The subagent prompt templates provide structural separation, but lack explicit boundary markers or instructions to disregard embedded commands in the interpolated task text.
Capability inventory: The agent possesses capabilities for file system modification, git operations, and local script execution.
Sanitization: Plan content is extracted via awk without specific sanitization for injection patterns.
Mitigation: The risk is significantly mitigated by the skill's mandatory review loops, including implementer self-review, independent task review, and a final whole-branch review.
[COMMAND_EXECUTION]: The skill executes local bash scripts and standard git utilities to manage its workflow.
Local Scripts: Uses scripts/sdd-workspace for directory management, scripts/task-brief for content extraction, and scripts/review-package for diff generation.
Git Operations: Utilizes git log, git diff, and git rev-parse to track progress and prepare code for review.
These commands are well-scoped to the development purpose and include basic checks to prevent path traversal.
[SAFE]: The skill follows secure practices for managing temporary data.
Workspace Isolation: Plan artifacts are stored in a dedicated .superpowers/sdd/ directory.
Accidental Exposure Prevention: The sdd-workspace script automatically creates a .gitignore file within the artifact directory to prevent sensitive reports or briefs from being committed to the repository.

subagent-driven-development