The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess calls to interact with external tools such as git, orca, and sideby. These are used for session discovery, task monitoring, and data integration.
Evidence: The implementation uses list-based arguments for subprocess calls in scripts/dispatch_board.py and scripts/sideby_cli.py, avoiding the shell and mitigating command injection risks.
Evidence: Discovery logic in scripts/probe_agents.py safely looks for binaries on the PATH and standard configuration directories to determine machine capabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes output from worker agents by reading JSONL event streams to update the Run Board.
Ingestion points: dispatch_board.py reads worker-generated .jsonl files (e.g., B9.jsonl).
Boundary markers: The skill defines a strict task-spec.md template that workers must follow when returning results, using specific field labels like Decisions: and UNVERIFIED: to help the coordinator distinguish data from instructions.
Capability inventory: The coordinator has access to file system and terminal tools via Bash, Write, and Edit to integrate worker changes.
Sanitization: The dashboard rendering logic in scripts/board_markdown.js applies a rigorous allow-list to all markdown output, ensuring that even if a worker agent emits malicious HTML/scripts, they are rendered as escaped plain text.

agent-dispatch