The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions require the agent to access and snapshot sensitive local files including .env, tokens, and keys to monitor for unauthorized changes during the planning phase.\n
Evidence: 'Snapshot ignored sensitive files (.env, tokens, keys). If they change, abort and restore.' (SKILL.md)\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute validation commands known as 'gates' in a detached worktree and re-run verification gates outside the worker context.\n
Evidence: 'Run the gate in a detached worktree of that tree. Require exit 0 and final line ALL GATES PASS.' (SKILL.md)\n
Evidence: 'verification_gates — commands the engine re-runs outside the worker' (SKILL.md)\n- [INDIRECT_PROMPT_INJECTION]: The skill processes an external 'goal' to generate structured plans containing executable steps and gate commands, creating a vector for instruction injection.\n
Ingestion points: The initial user-provided 'goal' described in the SKILL.md body.\n
Boundary markers: None present to distinguish untrusted goal data from system instructions.\n
Capability inventory: Local file writes to the .ralph/ directory, git commit-tree operations, and shell command execution via validation gates.\n
Sanitization: No input validation or sanitization mechanisms for the goal content are described.

ralph-plan