The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze development plans provided as local files, URLs, or direct text. These plans represent untrusted input that could contain malicious instructions intended to influence the agent's behavior or findings during the review process.
Ingestion points: Plan paths, URLs, or content provided via the primary skill arguments.
Capability inventory: The skill can execute shell scripts, write files to the disk, and spawn sub-agents for specialized reviews.
Boundary markers: The instructions explicitly tell the agent to distinguish between facts and unconfirmed assumptions and to treat plans as materials to be verified rather than established truths.
Sanitization: The skill does not explicitly describe sanitization or escaping of plan content before it is interpolated into sub-agent prompts or used as arguments for validation scripts.
[COMMAND_EXECUTION]: The skill instructions direct the agent to run local shell scripts, specifically check_paths.sh and check_progress.sh, if they are found within the target repository. While intended for plan validation, this capability could be exploited if malicious content from a development plan is passed as an unsanitized argument to these scripts.
[EXTERNAL_DOWNLOADS]: The architecture review lens encourages the agent to visit external URLs, such as official documentation, release notes, or technical papers, to verify technical claims. While this is for research, fetching content from arbitrary external sources introduces a potential vector for the ingestion of malicious content.

review-dev-plan