The Agent Skills Directory

[PROMPT_INJECTION]: The skill's error-correction mechanism in ff-collect.sh contains an indirect prompt injection surface. The do_repair function takes raw output from a sub-agent that failed validation and includes it in a new prompt to attempt a repair.
Ingestion points: Ingests output from <id>.result.json or <id>.last.txt (files written by sub-agents).
Boundary markers: The ingested data is interpolated directly into the prompt string without the use of XML tags, markers, or explicit instructions to ignore embedded commands.
Capability inventory: The sub-agents possess significant capabilities including shell command execution (Bash) and file system access (Read, Write, Edit, Grep).
Sanitization: No sanitization or escaping is performed on the worker's output before it is re-evaluated by the repair agent.
[COMMAND_EXECUTION]: The skill orchestrates sub-agents by executing various local CLI tools including git, jq, claude, and codex.
Sub-agents are launched in isolated OS processes with individual configuration directories (CLAUDE_CONFIG_DIR) to prevent session and credential leakage.
The skill includes a security feature called 'Escape Guard' (invoked via ff-collect.sh --check-main-clean) which uses git status comparisons against a baseline to ensure sub-agents have not written files outside their designated worktree isolation lanes.
The script _env.sh dynamically updates the PATH environment variable to ensure required tools are discoverable in various environments (Windows/Linux), targeting only standard user and program directories.

fleetflow