The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md require the agent to interpolate user-provided inputs—including the topic name, partner handle, and problem description—directly into shell commands for the amq utility. For example, amq send --to <partner> --kind question --labels workflow:spec,phase:request --thread spec/<topic> --subject "Spec: <topic>" --body "<problem>" is used for initialization. If these inputs are not properly sanitized by the platform, a malicious user could provide crafted strings containing shell metacharacters to execute arbitrary code.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates multi-agent coordination by reading and processing message bodies sent by external agents via the AMQ system.
Ingestion points: Untrusted data enters the agent's context through the amq drain --include-body and amq thread --include-body commands as specified in SKILL.md and references/spec-workflow.md.
Boundary markers: The workflow utilizes specific labels and kinds (e.g., workflow:spec,phase:research) to categorize input, though the content of the message body itself is treated as natural language for analysis.
Capability inventory: The skill uses amq send for communication and assumes standard codebase research capabilities (file read access).
Sanitization: There is no explicit sanitization of message bodies; however, the protocol mitigates risk by requiring a mandatory human approval step on a stable gate/<topic> thread before any execution or implementation occurs.

amq-spec