The Agent Skills Directory

[COMMAND_EXECUTION]: Instructions for backlog triage involve executing shell commands (gh issue create) with strings parsed from "Out of Scope" sections in project artifacts. This pattern is vulnerable to command injection if the artifact content contains malicious shell characters that the agent fails to sanitize.
[PROMPT_INJECTION]: The adaptive-constraints module features a "User Directive Override" mechanism that parses natural language phrases (e.g., "ignore scope guard", "be autonomous") to adjust the agent's governance profile. This allows for the intentional or unintentional relaxation of checkpoints and oversight gates.
[DYNAMIC_EXECUTION]: Employs the conjure delegation system to offload task execution to external tools or subagents. This creates a chain of trust where the orchestrator invokes capabilities outside its own direct logic.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project artifacts which are then used as context for future agent actions, creating a significant injection surface.
Ingestion points: docs/project-brief.md, docs/specification.md, and docs/implementation-plan.md (all of which can be manipulated by an attacker).
Boundary markers: No explicit markers are used to separate untrusted artifact data from the agent's system instructions during interpolation.
Capability inventory: Subprocess execution via gh CLI, skill invocation via Skill(), and local file system persistence in the .attune/ directory.
Sanitization: Artifacts are checked for structure and quality (e.g., minimum character counts) but are not sanitized for malicious instructional content or control characters.

mission-orchestrator