The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources including structure outlines, TDDs, PRDs, design discussions, and task tickets.
Ingestion points: Files located in .agent-work/tasks/ and companion documents discovered during the 'Establish the run' phase.
Boundary markers: The skill provides instructions to the delegated agent to prioritize the outline, but lacks explicit sanitization or markers to prevent the agent from obeying instructions embedded within the ingested documents.
Capability inventory: The skill has the ability to write code (via delegation), execute shell commands (ls, git), and run arbitrary validation scripts found in the repository.
Sanitization: There is no evidence of filtering or escaping instructions found within the project artifacts before they are processed by the agent.
[COMMAND_EXECUTION]: The skill uses shell commands for environment inspection and version control.
Evidence: Execution of ls -La to resolve symlinks in the task directory and various git commands to stage and commit implementation changes.
[DYNAMIC_EXECUTION]: The orchestrator is designed to execute validation items and integration checks defined within the project repository.
Evidence: Step 3 ('Enforce the automated gate') explicitly requires the agent to 'run any phase validation command the agent omitted' and 'run the repository's relevant broader integration checks.' This involves executing local scripts or binary commands specified in the project context.

implement-outline