The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill implements a 'Recitation' pattern that automatically reads task_plan.md before every Bash, Write, or Edit tool call via the PreToolUse hook.
Ingestion points: task_plan.md is read into the context window automatically.
Boundary markers: No delimiters or safety instructions are used when injecting the file content back into the prompt.
Capability inventory: The skill allows full Bash, Write, and Edit tool access.
Sanitization: There is no sanitization or validation of the content within the planning files before it is read.
Risk: If the agent performs a WebSearch or WebFetch (both allowed tools) and saves attacker-controlled instructions into findings.md or task_plan.md, those instructions will be executed with high privilege in the next loop.
Command Execution (LOW): The skill uses local shell scripts (scripts/init-session.sh, scripts/check-complete.sh) and hooks to manage planning state.
Evidence: The Stop hook executes ${CLAUDE_PLUGIN_ROOT}/scripts/check-complete.sh and the PreToolUse hook executes cat task_plan.md.
Assessment: These commands are fixed and do not involve dynamic interpolation of untrusted data into the shell command string itself, though the output of the command is the source of the prompt injection risk noted above.

planning-with-files