The Agent Skills Directory

[Indirect Prompt Injection] (LOW): The skill ingests untrusted data from existing project plan files to generate implementation tasks. This creates a surface where malicious instructions in a plan.md file could influence the agent's output written to the workspace.
Ingestion points: Reads plan.md or plan-<feature-name>.md from the local workspace.
Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore embedded prompts in ingested files.
Capability inventory: Uses Read, Grep, Glob, and Write tools to interact with local files. It does not have access to shell execution or network tools.
Sanitization: Absent. The skill interpolates data from input files directly into the generated Markdown templates without validation.
[Prompt Injection] (SAFE): No direct instructions to bypass safety filters, ignore system prompts, or adopt unrestricted personas were detected.
[Data Exposure & Exfiltration] (SAFE): No hardcoded credentials, sensitive file path access (e.g., SSH keys), or network operations (curl, wget) are present.
[Remote Code Execution] (SAFE): The skill does not download or execute remote scripts. While it generates "verification commands" (e.g., pytest), it lacks the tools to execute them autonomously.
[Persistence Mechanisms] (SAFE): No attempts to modify shell profiles, cron jobs, or startup services were found. It only creates project-specific Markdown files.

task-decomposition