The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its automated planning workflow. The PreToolUse hook automatically reads the first 30 lines of task_plan.md into the agent's context whenever sensitive tools like Bash, Write, or Edit are invoked. Since the agent is instructed to log all errors and research findings (from tools like WebSearch) into this file, an attacker could potentially influence the agent's behavior by causing malicious instructions to be saved in the plan file.
Ingestion points: task_plan.md is read into the context via the PreToolUse hook defined in SKILL.md.
Boundary markers: None. The content of the plan file is appended to the context without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has access to powerful tools including Bash, Write, Edit, and WebFetch (as defined in SKILL.md).
Sanitization: None. The raw content of the user-controlled plan file is re-injected into the session context.
[COMMAND_EXECUTION]: The skill uses lifecycle hooks to execute shell commands for session management and task verification.
Evidence: The Stop hook in SKILL.md executes ${CLAUDE_PLUGIN_ROOT}/scripts/check-complete.sh to verify task phases.
Evidence: The PreToolUse hook in SKILL.md executes cat task_plan.md 2>/dev/null | head -30 || true to refresh context.
Evidence: scripts/init-session.sh is provided to initialize the working environment. These commands are local and serve the stated purpose of the skill.

planning-with-files