The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts (result_ranker.py, session_manager.py, dag_analyzer.py, dry_run.py) utilize subprocess.run to interact with the Git CLI, execute user-defined benchmarking commands, and perform internal validation checks. While these are core functional requirements for a git-based orchestration tool, they involve shell execution (shell=True in result_ranker.py) of commands defined in the session configuration.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture involves a coordinator agent reading and evaluating output from parallel sub-agents, which creates a potential vulnerability to indirect prompt injection.
Ingestion points: The coordinator reads agent-generated markdown posts from .agenthub/board/results/ and analyzes Git diffs (git diff base...agent-branch) produced by sub-agents.
Boundary markers: The coordinator instructions in hub-coordinator.md and skills/eval/SKILL.md lack explicit delimiters or warnings to ignore instructions embedded within agent-generated content.
Capability inventory: The coordinator has significant capabilities, including spawning new agents via the Agent tool, executing shell commands through Python scripts, and modifying the local filesystem.
Sanitization: There is no evidence of sanitization or filtering of the sub-agent output before it is processed by the coordinator session.

agenthub