The Agent Skills Directory

[PROMPT_INJECTION]: The skill creates a significant indirect prompt injection surface through its state management mechanism.
Ingestion points: The PreToolUse hook defined in SKILL.md automatically executes cat task_plan.md to inject the first 30 lines of the planning file into the context window before every Write, Edit, Bash, Read, Glob, or Grep operation.
Boundary markers: The injected content lacks delimiters or instructions to the model to treat the file content as data rather than instructions.
Capability inventory: The skill grants access to powerful tools including Bash, Write, and Edit, which can be used to further compromise the environment if the agent follows injected instructions.
Sanitization: There is no sanitization or validation of the content within task_plan.md. If the agent is tricked into writing untrusted data (e.g., from a web search) into the plan file, it creates a persistent instruction loop.
[COMMAND_EXECUTION]: The skill utilizes lifecycle hooks to execute local scripts and shell commands.
The Stop hook in SKILL.md executes check-complete.ps1 using powershell.exe -ExecutionPolicy Bypass, which intentionally lowers the security posture on Windows systems to run the skill's local scripts.
The scripts/session-catchup.py script accesses sensitive internal application data located in ~/.claude/projects/. It parses .jsonl files containing previous conversation history and tool outputs. While this is the intended functionality for session recovery, it exposes potentially sensitive information from previous interactions to the current agent context.

planning-with-files