The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The suite's autonomous features, such as AgentHub and Autoresearch, involve the agent consuming data that could contain malicious instructions.
Ingestion points: The agent reads result summaries and logs from .agenthub/board/, reviews git diffs from sub-agent branches, and evaluates content in optimization targets (e.g., marketing copy, headlines, or system prompts).
Boundary markers: Content is formatted as markdown, but the skill lacks specific guardrails to prevent the agent from obeying instructions embedded within the processed text.
Capability inventory: The coordinator agent can spawn sub-agents, execute arbitrary shell commands via the evaluation harness, and merge code into the repository.
Sanitization: There is no evidence of sanitization for user-provided or agent-generated content before it is processed by the agent or passed to shell evaluators.
[COMMAND_EXECUTION]: The toolkit uses subprocess.run to interact with system utilities like git, docker, and language-specific compilers across many scripts. These high-privilege operations are fundamental to the toolkit's operation but require careful management to ensure they are only used for intended development tasks.
[DYNAMIC_EXECUTION]: Multiple components, including the result ranker and experiment runner, execute shell commands read from configuration files (config.yaml, config.cfg). Using shell=True with these dynamically loaded strings poses a risk of command injection if the underlying configuration files are modified by a malicious actor or a compromised sub-agent.

engineering-advanced-skills