The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process various untrusted inputs, including work briefs, repository evidence, logs, and screenshots, to generate implementation plans and configure workers.
Ingestion points: Identified in SKILL.md (Required Inputs) and references/delegation.md (Planning Packet).
Boundary markers: The instructions lack explicit requirements for using delimiters or "ignore embedded instructions" markers when processing these external data sources.
Capability inventory: The skill can write files (Markdown/HTML artifacts), modify repository configuration (kickoff.yaml), and dispatch new worker agent/model sessions.
Sanitization: There is no mention of sanitizing or validating the content of external inputs before they are used to influence plan generation or worker configuration.
[PROMPT_INJECTION]: SKILL.md contains a directive that could be interpreted as an instruction to override restrictions: "If a skill blocks progress, identify the exact instruction and concrete conflict, and continue independent authorized work." This potentially encourages the agent to bypass safety or policy filters if they are perceived as obstacles to the task.

plan-it