The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection because it ingests untrusted milestone data and flows output from one stage (plan-crafting/run-plan) into the next as context. Although the skill employs 'information-isolated' validators and reviewers, the autonomous execution model (bypassing approval gates between milestones) increases the risk of an injection in an early milestone influencing subsequent planning or execution steps without human oversight.
Ingestion points: The skill reads untrusted data from milestones/*.md files and the session state.md file. It also incorporates 'Context Briefs' derived from the output of previous milestones.
Boundary markers: The skill defines a 'Context Brief contract' (Step 2-2) that limits predecessor context to file lists and interface contracts, specifically excluding execution logs and review documents to reduce noise and potential injection vectors.
Capability inventory: The harness performs file system writes (checkpoints and state updates), manages git worktrees for isolation, and invokes other skills (plan-crafting, run-plan, review-work) which may execute shell commands or code.
Sanitization: Validation steps include checking the dependency DAG for cycles and verifying state consistency. The review phase uses isolated agents to provide a binary PASS/FAIL verdict based on the original plan.

long-run