The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes markdown plan files and uses their contents to generate prompts for subagents, creating a surface for indirect prompt injection.
Ingestion points: Markdown files provided in the command (e.g., plan.md) are read and parsed in Step 2 of the workflow.
Boundary markers: The Task Prompt Template in Step 3 lacks delimiters or explicit instructions to treat the plan's content as untrusted data, which could lead the subagent to follow instructions embedded within the plan rather than the intended task.
Capability inventory: Subagents are authorized to read and edit files in the repository and are encouraged to run validation steps (Step 3, Instruction 5), which may involve executing shell commands or scripts.
Sanitization: No sanitization or filtering is applied to the extracted task descriptions or acceptance criteria before they are interpolated into the subagent prompt.
[COMMAND_EXECUTION]: The orchestration workflow encourages subagents to perform actions that typically involve command execution.
The subagent instructions include 'Run validation if feasible', which in a development context implies executing tests, linters, or build scripts defined in the repository or plan content, potentially leading to the execution of malicious code if the repository state or plan is compromised.

parallel-task