The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions create a significant surface for indirect prompt injection by designating external plan files as the absolute source of truth for the agent's actions. | Ingestion points: The workflow reads and processes plan files from the .opencode/plans/ directory. | Boundary markers: The skill explicitly directs the agent to 'follow every instruction in the plan thoroughly' and 'not improvise, skip, or reinterpret scope', which reduces the agent's skepticism toward potentially malicious instructions embedded in those plans. | Capability inventory: The agent has the capability to write code via coder agents and execute shell commands for testing, linting, and type-checking (e.g., npm test, pytest, go test). | Sanitization: No technical validation or sanitization is performed on the plan files before the orchestrator begins delegating tasks based on their content. | Mitigation recommendations: Implement explicit boundary markers when reading the plan file and include an initial 'Think' step for the build agent to specifically check the plan for suspicious or unsafe instructions before decomposition.

perfectcode-zen-implement