The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and process data from untrusted repository files.
Ingestion points: The workflow in SKILL.md requires the agent to read and inspect several repository files, including .conductor/settings.toml, conductor.json, .worktreeinclude, and all shell scripts within the .conductor/ directory.
Boundary markers: The instructions do not provide specific markers or prompts to isolate untrusted data from the agent's core instructions, increasing the risk that instructions embedded in repository files could be followed.
Capability inventory: The agent has the ability to write to the file system and execute shell commands to validate the environment.
Sanitization: While TOML validation is mentioned, there are no instructions to sanitize or escape content read from repository scripts before they are processed or executed.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute shell scripts from the repository to verify the setup.
Evidence: SKILL.md Step 5 mandates running "the narrowest relevant check for every script changed," and references/scripts-and-environment.md provides examples of executing repository scripts like ./.conductor/setup.sh using bash or zsh shells.

conductor-setup