The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/loop_controller.py script uses subprocess.run() with shell=True to execute verification commands stored in the task plan. This allows the execution of any system command provided in the JSON input.
[DYNAMIC_EXECUTION]: The skill's core logic involves loading and executing commands dynamically from external JSON files (plan.json and state.json). There is no restricted environment or whitelist for these commands, meaning the skill's security depends entirely on the integrity of these data files.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Untrusted data enters the agent context through the --goal argument in scripts/goal_compiler.py, which determines which tasks and commands are added to the execution plan.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the ingested goal string before it is processed into the task list.
Capability inventory: The skill has the capability to execute arbitrary subprocesses, read/write files for state management, and manage directory structures across the repository (scripts/loop_controller.py, scripts/harness_manifest_builder.py).
Sanitization: The command strings pulled from the plan are executed without sanitization or validation against a safe command schema.

agent-harness