The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to execute Stage 6 operations, including git push and gh pr create, using a BypassSandbox: true configuration. This is a direct request to escape the platform's security container to access host-level network resources and OS credentials.
[CREDENTIALS_UNSAFE]: The orchestration protocol (detailed in references/subagent-providers.md) requires the agent to copy sensitive configuration and credential files, such as .env, keystore.properties, and local.properties, from the repository root into temporary git worktree directories. This practice replicates secrets across the filesystem and increases the risk of data exposure if sub-agents or worktrees are compromised.
[COMMAND_EXECUTION]: The skill makes extensive use of shell commands for lifecycle management, including complex git worktree operations, GitHub CLI interactions (gh auth status, gh pr list), and Android build environment tasks (./gradlew prepareKotlinBuildScriptModel).
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing external data from feature_list.json and user-provided feature descriptions while maintaining high-privilege capabilities.
Ingestion points: The agent reads feature_list.json, PROGRESS.md, and user-supplied feature requests in Stage 1.
Boundary markers: No explicit sanitization or delimiters are defined for the instructions parsed from the feature backlog.
Capability inventory: The skill has the ability to write files, execute shell commands, manage git branches/worktrees, and bypass the execution sandbox.
Sanitization: The instructions do not specify validation or filtering of content ingested from the feature queue before processing.

workflow-orchestrator