The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent stores research and findings in markdown files (e.g., findings.md) to serve as persistent 'working memory'. This creates an attack surface for indirect prompt injection, as malicious instructions embedded in external web content could be saved to these files and subsequently obeyed by the agent during its planning and decision-making phases.
Ingestion points: findings.md, task_plan.md, and progress.md (read via the Read tool or automated hooks).
Boundary markers: Absent. The templates use standard Markdown structure but do not include explicit delimiters or instructions to ignore embedded commands within the research sections.
Capability inventory: The agent has access to Bash, Write, Edit, WebFetch, and WebSearch tools, allowing for system interaction and external data retrieval.
Sanitization: None. The skill does not provide mechanisms to sanitize or validate external content before it is stored in the planning files or read back into the context.
[COMMAND_EXECUTION]: The skill automates task verification and session management through local scripts.
The Stop hook automatically executes check-complete.sh or check-complete.ps1 upon session termination to verify that all phases in the task plan are marked as complete.
The session-catchup.py script is intended to be executed at the start of a session to parse internal application session logs (~/.claude/projects/) and summarize past interactions. While this facilitates context recovery, it involves reading historical interaction data from the local filesystem.
The PreToolUse hook executes cat task_plan.md to refresh the agent's context before every tool call.

planning-with-files