The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses an {eval_cmd} placeholder to execute shell commands within agent worktrees. If the value of this placeholder is derived from untrusted session metadata or user input, it allows for arbitrary command execution on the host system.
[DYNAMIC_EXECUTION]: The skill invokes local Python scripts (result_ranker.py and session_manager.py) with dynamic arguments including {session-id} and {eval_cmd}. This runtime assembly and execution of commands with variable input poses a risk of argument injection.
[INDIRECT_PROMPT_INJECTION]: The 'LLM Judge' mode reads and ranks agent-generated content, creating a surface for adversarial content to influence the agent's evaluation logic. 1. Ingestion points: Agent result markdown files (.agenthub/board/results/agent-{i}-result.md) and git diff outputs. 2. Boundary markers: None; the skill does not define specific delimiters or instructions to the judge to ignore malicious patterns within the results. 3. Capability inventory: Execution of shell scripts and modification of session state files. 4. Sanitization: No sanitization or validation steps are described for the agent-generated data before it is presented to the LLM judge.

eval