The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests arbitrary user input (referred to as "braindumps") which is then formatted and passed directly into the prompts of autonomous sub-agents during Phase 1 (Step 5) and Phase 2 (Step 9). These sub-agents have the capability to write to the filesystem and execute commands based on the instructions they receive. The prompt templates lack robust delimiters or sanitization to prevent malicious instructions embedded in the user's data from hijacking the sub-agents' behavior.
Ingestion points: User-provided goal descriptions and notes stored in docs/plans/goal-analysis.md (as described in SKILL.md).
Boundary markers: The skill uses basic Markdown headers to separate user goals from instructions, which does not provide a strong security boundary against instruction hijacking.
Capability inventory: The orchestrator spawns agents via platform tools (e.g., Claude Code Agent tool) that are given full read/write access to the codebase and shell execution capabilities.
Sanitization: The skill performs an LLM-based "organization" step (Step 1) to structure the data, but it lacks programmatic sanitization, escaping, or strict schema validation for the content injected into sub-agent prompts.
[COMMAND_EXECUTION]: The skill executes shell scripts (scan-project.sh, init-plan-dirs.sh) to perform environment reconnaissance and project setup. scan-project.sh probes for project configuration files (such as package.json and tsconfig.json) and searches for other installed skills in system and user directories (~/.claude/skills/, /mnt/skills/). While this reconnaissance is intended to provide project context for the agents, it involves systematic probing of the user's local environment.

team-executor