The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands for state rotation, database queries (via bun), and tool execution (via npx tsx). While these appear to be internal maintenance tasks, they involve parsing and interpolating mission slugs and JSON data into shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from various repositories (trading, onenation, autonomy, local-models), including PR descriptions, logs, and ledger entries. This creates an attack surface where malicious content in these sources could influence the agent's judgment during the oversight phase.
Ingestion points: Reads repository state, director logs (.arc/director/*), PR metadata, and ledger database rows (feedback table) in SKILL.md.
Boundary markers: None explicitly defined for isolating content from external repositories or PR bodies during processing.
Capability inventory: Subprocess calls for bun, npx tsx, git, docker, and sqlite operations throughout SKILL.md.
Sanitization: Limited to 'tolerant JSON parsing' and regex usage (grep -o), which does not protect against instructions embedded within the data fields themselves.
[PRIVILEGE_ESCALATION]: The skill documentation mentions managing Docker stacks and notes that 'gates you cannot resolve (sudo...)' should be surfaced, indicating an awareness of and potential interaction with privileged operations, although it advises against executing gated actions directly.

auto-oversight