The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the orchestrator agent to execute shell commands such as mkdir, cp, and wc, and to invoke local analysis scripts (lint.sh, frequency.py). These commands incorporate parameters like the file path and project slug derived from user input, which presents a potential surface for command injection if the agent fails to properly escape these inputs before execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted prose drafts which are processed by multiple subagents (Catalog, Fix, and Verifier) for rewriting and validation.
Ingestion points: The content of the prose draft (at <draft path>) is read and manipulated across several pipeline stages.
Boundary markers: Prompt templates use basic labels like Draft: <absolute draft path>, but they lack explicit instructions for subagents to ignore or isolate instructions that might be embedded within the draft text itself.
Capability inventory: The orchestrator agent has access to file system operations and script execution (Bash and Python).
Sanitization: The skill does not perform sanitization on the draft content. However, it implements strong architectural mitigations, including a 'regression gate' (word count and lint delta checks) and a 'cold verifier' agent that compares the final result against a baseline to detect meaning drift or unauthorized changes.

catalog-deslop