The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon feedback generated by the plannotator tool to revise assistant messages. This creates a surface for indirect prompt injection where malicious instructions embedded in the feedback could influence the agent's logic or behavior.
Ingestion points: Output from the plannotator annotate-last command.
Boundary markers: None identified in the prompt templates.
Capability inventory: Execution of the plannotator tool via bash.
Sanitization: No explicit sanitization or validation of the feedback content is mentioned.
[COMMAND_EXECUTION]: The instruction to run plannotator annotate-last $ARGUMENTS uses a variable for arguments. While the execution is scoped to the plannotator command via the allowed-tools configuration, the use of unvalidated arguments in a shell context poses a minor risk of argument injection.

plannotator-last