The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize multiple external artifacts ('returns') from a working directory, creating a significant attack surface for indirect prompt injection.\n
Ingestion points: The agent is instructed to read phase-3-dispatch-log.md and the contents of all files found in the returns/ directory.\n
Capability inventory: The agent uses Read, Write, Edit, Glob, and Grep tools to manipulate the file system. While no network exfiltration is present, the agent could be manipulated into creating, modifying, or deleting files based on injected instructions.\n
Boundary markers: There are no explicit instructions or delimiters used to separate the external return data from the agent's core reconciliation logic, increasing the likelihood that the LLM may follow instructions embedded within those returns.\n
Sanitization: The skill performs no validation, filtering, or sanitization of the return content before it is extracted and composed into the final artifact.\n- [COMMAND_EXECUTION]: In Step 6a, the skill explicitly directs the agent to execute the wc command-line utility (e.g., wc -w) on local files to compute compression ratios. While wc is a standard and typically safe utility, this confirms the agent is expected to perform shell command execution as part of its workflow.

coliseum-reconciliation