The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill architecture involves an 'Identity Broker' that mounts sensitive credential directories from the host machine into Docker containers. Specifically, it mentions mounting ~/.claude to /home/worker/.claude:ro. This exposes host-level CLI session tokens and authentication data to the containerized environment.
[COMMAND_EXECUTION]: The skill requires and executes several CLI tools on the host system, including docker, orbctl, and a local polyphony binary used for initialization and task spawning.
[EXTERNAL_DOWNLOADS]: The worker runtime relies on an external Docker image, polyphony-worker:latest, which is retrieved from a remote container registry at runtime.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from external sources.
Ingestion points: Tasks are sourced from GitHub Issues via the gh api (referenced in SKILL.md).
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions when passing issue content to the agents.
Capability inventory: The skill has the capability to spawn Docker containers, execute git operations, and run agent CLI commands.
Sanitization: There is no mention of sanitizing or validating the content of GitHub issues before it is used to drive agent behavior and task routing.

polyphony