The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a Python script (scripts/plans.py) to execute shell commands via subprocess.run(). These commands are primarily used for git operations, including commit, rename, mv, and push. While necessary for the skill's functionality, shell execution remains a classic attack vector.
[DATA_EXFILTRATION]: The skill facilitates data movement through git push operations to remote repositories. Although the documentation states this is restricted to user-configured 'sanctioned remotes' and is preceded by a content scan, the capability to transmit local data to external servers exists.
[INDIRECT_PROMPT_INJECTION]: The skill operates by reading and parsing markdown files (plans/*.md), git history, and session transcripts. These sources represent untrusted data entry points where malicious instructions could be embedded to influence the agent's behavior during processing.
Ingestion points: Reads plans/ markdown files, $PLANS_HOME directories, git history, and Claude Code session transcripts ($CLAUDE_CODE_SESSION_ID).
Boundary markers: The skill uses a dedicated Python script to parse data, which provides some structural separation, but does not employ explicit 'ignore instructions' delimiters for the markdown content.
Capability inventory: The skill can write files, execute git commands (including rm and push), and read sensitive transcript data.
Sanitization: Implements a scan command designed to detect and block the publication of private terms or client identities based on the local project structure.

plan-conveyor