The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core logic is driven by the contents of files such as MISSION.md, AGENTS.md, and CHOICES.md, which are sourced from the project repository.
Ingestion points: SKILL.md and sys_driver.md explicitly instruct the agent to read these markdown files to determine its objective and task list.
Boundary markers: The instructions do not specify any delimiters or sanitization protocols for the content of these files before they are processed.
Capability inventory: The skill is capable of performing git merge operations, spawning background workers, and executing production deployments.
Sanitization: The risk is mitigated by the mandatory use of the defend skill family (DefendPlan, DefendMerge, DefendRelease), which routes critical decisions through high-tier models (Anthropic Opus) for verification.
[COMMAND_EXECUTION]: The skill interacts with the system via specialized command-line tools and shell operations.
Evidence: Uses herdr for managing persistent panes and beads CLI for querying and updating task states.
Evidence: Performs git merge operations as part of the code integration workflow.
[REMOTE_CODE_EXECUTION]: The skill delegates work to ephemeral agents, which involves spawning and monitoring new processes.
Evidence: Utilizes bg_delegate and bg_run_pi_attested to run worker agents. The bg_run_pi_attested pattern suggests the use of process isolation and attestation for security when executing worker code.

driver