The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon .plan.md files, which are treated as user-authored input. This creates a surface where a malicious plan could attempt to influence the agent's behavior.
Ingestion points: The agent reads and processes .plan.md files (SKILL.md, Step 0 and Step 1).
Boundary markers: The skill defines a "Trust Boundary" and a "Trust Model Summary" to help the agent distinguish between verified metadata and implementation instructions.
Capability inventory: The agent is instructed to execute shell commands (Step 2: Exit Gates), perform file modifications (Step 1 and Completion), and manage plan metadata.
Sanitization: The skill explicitly instructs the agent to pause and confirm with the user if a plan command appears unrelated to the objective, exfiltrates data, or accesses sensitive paths like ~/.ssh or ~/.aws.

tl-agent-plan-execute