The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by interpolating untrusted data into the instructions for delegated sub-agents.
Ingestion points: Untrusted data enters the skill context through the {goal}, {detailed_requirements}, and {project_context} variables in SKILL.md during Phase 1.
Boundary markers: Absent. The skill does not use delimiters or explicit "ignore embedded instructions" warnings when passing these variables to delegate_task.
Capability inventory: The skill uses delegate_task for sub-agent coordination and omh_state for file operations. It also explicitly requires the terminal toolset, allowing sub-agents to potentially execute shell commands.
Sanitization: Absent. There is no evidence of validation, filtering, or escaping of the input variables before they are interpolated into the sub-agent goals.
[COMMAND_EXECUTION]: The skill operates by delegating tasks to sub-agents who are granted access to the terminal toolset. While the skill's primary purpose is planning, the underlying mechanism allows for arbitrary command execution by the sub-agents (Planner, Architect, Critic) if they are successfully compromised via prompt injection.

omh-ralplan