The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill is susceptible to indirect prompt injection via the Plans.md file.
Ingestion points: The agent reads task descriptions and implementation requirements directly from Plans.md (referenced in SKILL.md and implementing-features.md).
Boundary markers: None identified; there are no instructions to ignore or sanitize embedded instructions within the task descriptions.
Capability inventory: The skill has high-privilege capabilities including Bash command execution, Write, and Edit file operations.
Sanitization: There is no evidence of input validation or escaping for the content read from Plans.md before it influences the agent's actions.
[Command Execution] (SAFE): The skill uses Bash for standard development tasks such as running tests (npm test), building projects (npm run build), and type checking (npx tsc). These are appropriate for its stated purpose as a coding assistant.
[Data Exposure & Exfiltration] (SAFE): The skill identifies sensitive directories (auth, login, payment) and prompts the agent to provide security checklists. This is a defensive feature that reduces the likelihood of accidental credential exposure during implementation.

impl