The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on processing external plan files (e.g., docs/plans/<slug>.md) which define the implementation steps.
Ingestion points: The agent reads task definitions and verification commands from external markdown files within the repository.
Boundary markers: The skill lacks explicit instructions or delimiters to distinguish between legitimate plan data and potential malicious instructions embedded within those files.
Capability inventory: The skill has the authority to write code to the local filesystem and execute shell commands for build and test processes.
Sanitization: There is no requirement for sanitizing the input from these plan files before implementation.
[SAFE]: The skill documentation includes several specific security controls and best practices.
It explicitly commands the agent never to read .env or secret file contents, even during configuration discovery.
The execution loop includes a mandatory diff inspection step to ensure no secrets or sensitive debug artifacts are introduced to the codebase.
The skill references documentation and implementation patterns from well-known and reputable sources, including official Git documentation and Anthropic engineering reports.

pilot