The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from implementation plans and GitHub issues, creating a potential surface for indirect prompt injection. However, the design includes comprehensive mitigations that align with security best practices for AI agents:
Ingestion points: Data enters the system from user-specified file paths (e.g., ~/.claude/plans/*.md) or by fetching issue content via the gh CLI.
Boundary markers: The orchestrator uses XML-style <plan> tags to encapsulate untrusted subject content in the prompt template sent to subagents.
Capability inventory: Subagents are strictly limited to read-only tools (Read, Grep, Glob, WebSearch, WebFetch, Context7 MCP). The skill instructions explicitly prohibit subagents from using Write, Edit, or any shell-based Bash tools, preventing potential injection from affecting the codebase or system state.
Sanitization: The skill includes an explicit instruction to avoid pasting verbatim snippets into web searches or external tools, mandating the use of generic queries to prevent data exfiltration.

plan-critics