The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes instructions like '#YOLO' and explicit directives to 'Skip all "WAIT for user" instructions' and 'Assume the user will NOT provide any input'. These patterns are designed to override the agent's default behavior of waiting for user confirmation before performing sensitive actions.
[COMMAND_EXECUTION]: The orchestrator executes various shell commands, including tmux for session management and git for committing code. It also invokes other AI CLI tools (Claude and Codex) with high-privilege flags such as --dangerously-skip-permissions and --full-auto.
[DYNAMIC_EXECUTION]: The Python backend dynamically generates shell scripts (runner and command scripts) in the system's temporary directory (/tmp) and executes them within tmux panes. It also uses dynamic imports for standard system modules.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from story files and session logs, which are then interpolated into prompts for analysis sub-agents. This creates a surface where malicious content in a story file could influence the orchestrator's parsing logic.
Ingestion points: Found in src/story_automator/commands/orchestrator_parse.py, where session output is read from disk via read_text and passed to a sub-agent prompt.
Boundary markers: The prompt construction in _build_parse_prompt lacks robust delimiters to separate the system instructions from the untrusted session output.
Capability inventory: The skill possesses capabilities for subprocess execution (src/story_automator/core/utils.py), file system modification (src/story_automator/core/common.py), and network access via the agents it orchestrates.
Sanitization: While shell-level sanitization is performed via shlex.quote, there is no specific filtering or escaping of natural language prompt injection markers within the ingested data.

bmad-story-automator