The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill creates a significant indirect prompt injection surface by ingesting untrusted data from multiple sources.
Ingestion points: Reads codebase files like codebase-summary.md and reports from researcher subagents which may contain content from external lookups.
Boundary markers: Absent. Content is passed directly to the planner subagent without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can write multiple implementation files, execute local scripts, and perform slash commands based on the injected data.
Sanitization: Absent. Malicious content in the codebase could hijack the subagents to generate backdoored implementation plans or manipulate the agent into executing commands.
[COMMAND_EXECUTION] (MEDIUM): The skill executes node .claude/scripts/set-active-plan.cjs {plan-dir}. This pattern is dangerous when interacting with untrusted repositories, as an attacker can place malicious code in the .claude/scripts directory which the skill will then execute automatically. Additionally, the {plan-dir} argument is derived from environment metadata which may be subject to manipulation.

plan-hard