The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from the $request argument and integrates data from the local repository (via Read and Grep) to produce execution plans. This creates a potential vulnerability where malicious content in the request or repository could influence the generated tasks.
Ingestion points: SKILL.md identifies the $request argument and specifies the use of Read, Glob, and Grep tools to ingest repository content.
Boundary markers: The skill contains instructions to ground all paths in observed repository state and requires a scope-challenge step with the user, which provides a layer of verification, though it lacks technical delimiters for the ingested data.
Capability inventory: The skill uses Write and TodoWrite to generate files containing validateCommand strings intended for shell execution by subsequent processes.
Sanitization: The instructions do not explicitly mandate sanitizing or escaping user-provided text before it is written into the JSON and Markdown plan artifacts.
[DYNAMIC_EXECUTION]: The skill generates script-like content by constructing shell commands (validateCommand) and writing them to persistent storage in .ulpi/plans/. These commands are derived from the analyzed codebase and the user's request. Although the skill itself does not invoke the shell, the production of executable strings based on external inputs is a form of dynamic content generation that requires downstream caution.

plan-to-task-list-with-dag