The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's Stop hook contains logic to execute local scripts using powershell -ExecutionPolicy Bypass and pwsh -ExecutionPolicy Bypass. This technique is used to override system-level execution policies that are intended to restrict the running of untrusted or unsigned scripts.
[COMMAND_EXECUTION]: The skill triggers the execution of various internal scripts, including session-catchup.py, check-complete.sh, and check-complete.ps1, during its lifecycle hooks or through explicit documentation instructions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates potentially untrusted data from the filesystem into the agent's context without proper isolation.
Ingestion points: The PreToolUse hook automatically reads the first 30 lines of task_plan.md whenever core tools are used. The documentation also instructs the agent to read findings.md and task_plan.md to recover state.
Boundary markers: No delimiters, tags, or 'ignore instructions' warnings are used when the agent reads these files to distinguish between data and commands.
Capability inventory: The skill allows the use of powerful tools including Bash, Write, Edit, WebFetch, and WebSearch.
Sanitization: No mechanism is present to sanitize or validate content before it is written to the planning files or after it is read by the agent, allowing a malicious external source (via WebFetch) to inject instructions that the agent may later obey.

planning-with-files