The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to make decisions based on untrusted data read from disk, creating an attack surface where malicious instructions could be embedded in project files.
Ingestion points: Reads the user's current goal, active plan files (docs/plans/*.md), mutable state files, verification evidence, and architecture/research documents from .agents/** or the project's task directory.
Boundary markers: Absent. The skill does not define delimiters or instruct the agent to ignore instructions found within these files.
Capability inventory: The skill directs the agent to execute a 'next move,' which typically involves shell command execution (subprocess.run), file writing, and network operations depending on the agent's broader toolset.
Sanitization: Absent. Data read from these files is used directly to determine the 'Verdict' (keep course, pivot, replan) and the 'Next move.'
[DYNAMIC_EXECUTION]: The skill uses computed paths to load and execute other skill files based on state variables.
The instructions specify that if current_pass_skill is missing, the agent should infer the path as .agents/skills/<current_pass>/SKILL.md and load that skill.
This dynamic loading mechanism allows the execution flow to be redirected to arbitrary local skill files based on the content of the current_pass variable in a state file.

continue