The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a system that ingests untrusted data from subagent responses, external command outputs, and workspace files, creating a potential surface for indirect prompt injection where malicious data could influence downstream agent behavior.
Ingestion points: Data enters the workflow context via agent.ask results, world.run outputs (stdout/stderr), and file system operations like files.read and git.diff.
Boundary markers: The skill explicitly recommends architectural boundaries, such as using JSDoc property comments to provide field descriptions for the model and using typed interfaces to constrain the structure of subagent outputs.
Capability inventory: The workflow system provides high-privilege capabilities including arbitrary shell command execution via world.run, reading of all workspace files via files.*, and publishing deliverables via artifact.*.
Sanitization: The skill advocates for several robust security mitigations, including 'Fresh Eyes' (reviewing drafts in a separate, independent context) and mandatory 'Independent Confirmation' (reproducing findings using deterministic checks or a separate subagent that has not seen the original finding).
[COMMAND_EXECUTION]: The skill provides instructions for the world.run tool which executes shell commands. However, it explicitly instructs agents to use compile-time string literals for command names and only interpolate user/runtime data into the arguments array, which is a key security measure against command injection attacks.

dynamic-workflows