The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data including roadmap items, research documents, and web content.
Ingestion points: The agent reads roadmap/<slug>/README.md, research files in research/, and external web content cited as evidence for planning.
Boundary markers: The skill uses structured file paths and markdown headers. It implements a "frozen contract fingerprint" in check.sh to detect unauthorized modifications to plan files.
Capability inventory: The skill writes files, executes shell commands via check.sh, performs Git operations (commit, push, clone), and runs local TypeScript scripts (scripts/plan-package.ts).
Sanitization: Explicit instructions in references/runtime-trust.md and SKILL.md direct the agent to treat all read content as data rather than instructions and to flag any embedded instructions.
[COMMAND_EXECUTION]: The skill executes various shell commands and Git operations as part of its core logic.
Evidence: The check.sh script uses git status, git hash-object, and git rev-parse. It also executes "gate" and "proof" commands defined in the START.md file.
[DYNAMIC_EXECUTION]: The skill generates shell scripts and command blocks that are executed at runtime.
Evidence: The check.sh script dynamically parses and executes commands from the START.md file using sh -c. These commands are generated by the agent during the planning phase based on project research and input data.
Mitigations: The skill enforces a "planning-time proof" requirement, where the agent must successfully execute and record the unit count of any command before it is included in the final goal package.
[EXTERNAL_DOWNLOADS]: The skill clones external repositories for reference during the planning process.
Evidence: Instructions in SKILL.md specify cloning reference projects into a disposable directory to use as read-only evidence. This involves network access to download third-party code based on URLs found in roadmap items.

tailrocks-plan