The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a persistent 'working memory' by writing goals, research findings, and progress to markdown files (task_plan.md, findings.md, progress.md). This process creates a surface for indirect prompt injection if untrusted data retrieved during the research phase is stored in these files and subsequently re-read by the agent as authoritative instructions.
Ingestion points: Untrusted data enters the agent context via the Read, Grep, and Glob tools and is then recorded into the planning files as specified in SKILL.md and references/templates.md.
Boundary markers: The provided templates and instructions do not include boundary markers or explicit instructions for the agent to ignore embedded commands within the captured data.
Capability inventory: The skill is authorized to use Read, Write, Edit, Glob, and Grep tools to manage these persistent files.
Sanitization: There is no evidence of sanitization, filtering, or validation of external content before it is interpolated into the planning files.

planning-with-files