The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions and contracts found in external project files, creating an attack surface where malicious data could influence agent behavior.
Ingestion points: SKILL.md, review.md, and investigation.md direct the agent to read and follow project-specific files like request.md and contract.md to establish the "Contract" for work.
Boundary markers: While the skill utilizes a "verifier" and "judge" role for oversight, there are no explicit instruction-level delimiters within the ingested files described in the markdown body.
Capability inventory: The skill has access to tools that execute shell commands (evidence.ts) and manage a shared ledger (ledger.ts).
Sanitization: No explicit sanitization or filtering of external content is defined in the instructions before processing it through the agent's logic.
[COMMAND_EXECUTION]: The skill includes dedicated utilities for executing commands and capturing runtime facts, which are necessary for its coding tasks but represent a privileged capability.
scripts/src/evidence.ts uses node:child_process.spawn to execute a literal argument vector provided by the agent or user for capturing execution evidence.
scripts/src/coordinator.ts invokes an external CLI tool named herdr to manage agent status and communications in joint investigations.
Multiple evaluation and staging scripts (e.g., evals/levels/setup.py, evals/review/setup.py) utilize subprocess.run to prepare testing environments.

coding