The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill advocates for a "repair ladder" pattern where an agent is instructed to read generated evidence files (e.g., evidence/unit.json) to diagnose and fix failures. This creates a vulnerability surface where a malicious or compromised test suite could inject instructions into the evidence file to influence the agent's behavior during the repair phase.
Ingestion points: The agent steps repair-unit and repair-edit-schema are explicitly instructed to "Read evidence/unit.json" (SKILL.md).
Boundary markers: The instructions lack delimiters or warnings to the agent that the file content should be treated as potentially untrusted data rather than instructions.
Capability inventory: The workflow allows agents to modify source code, stage files with Git, and execute commands via the f.run interface.
Sanitization: There is no guidance on sanitizing the command output or evidence logs before they are presented to the repair agent.
[DYNAMIC_EXECUTION]: The skill recommends a design for a gates.mjs utility that decodes and executes Base64-encoded shell commands. This pattern is used to bypass shell interpretation issues but involves dynamic execution of obfuscated content.
Evidence: The description of gates.mjs states it will "Decodes and runs the command" provided via the --command-base64 flag (SKILL.md).
[COMMAND_EXECUTION]: The workflow relies on the execution of various CLI tools to validate the project state, including npx, vitest, and git. While these are standard development tools, they represent the primary capability surface through which an agent interacts with the host system.
Evidence: Instructions include running npx --no vitest run, git status --short, and custom Node.js scripts (SKILL.md).

relay-80-100-workflow