The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/plans.py uses subprocess.run() to execute shell commands, specifically for Git operations.\n
Evidence: Static analysis flagged subprocess.run() calls in scripts/plans.py that execute via the system shell.\n
Risk: The skill instructions specify that the script accepts arguments from the user and processed files, including topic names (new <topic>), status descriptions (blocked on <reason>), and commit messages (commit -m "<msg>"). These inputs are often supplied by the user or read from plan files. If not correctly sanitized before being passed to a shell, shell metacharacters (e.g., ;, &&, |) could be used to execute arbitrary commands on the host system.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from markdown plan files which could contain malicious instructions for the AI agent.\n
Ingestion points: The skill reads and "absorbs" content from plans/*.md files in the repository and the central $PLANS_HOME store via the absorb command.\n
Boundary markers: The skill does not implement explicit delimiters or "ignore instructions" warnings for processed file content when summarizing or taking actions based on plan content.\n
Capability inventory: The scripts/plans.py script has the capability to write files, modify system configuration ($PLAN_DOCS_CONFIG), and execute shell commands via Git.\n
Sanitization: No sanitization of file content is performed to prevent prompt injection beyond a privacy scanner that looks for specific terms.

plan-docs