The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The architect agent reads and interprets data from the handoff.md file, including 'Gate results' and 'Open disagreements' sections populated by a separate builder agent. This ingestion of AI-generated content creates a surface for indirect prompt injection. \n
Ingestion points: handoff.md (via handoff.mjs section get).\n
Boundary markers: Markdown headers are used as delimiters.\n
Capability inventory: Local file system access and shell command execution via dispatch.sh.\n
Sanitization: Instructions in SKILL.md advise ignoring narrative text, but no programmatic sanitization is applied to the ingested content.\n- [DYNAMIC_EXECUTION]: The dispatch.sh script dynamically constructs shell commands and writes them to temporary .sh files for execution via front-ends like herdr or tmux. The notify-turn-ended.sh script also performs dynamic command chaining based on user-provided configuration.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill launches various builder harnesses (codex, claude, opencode, etc.) and supports custom command templates defined in ~/.borkweb-skills/config.json. These builders are often launched with relaxed permissions (e.g., --dangerously-bypass-approvals-and-sandbox), which is a documented risk inherent to the skill's purpose.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill interacts with multiple local configuration and state files, such as ~/.borkweb-skills/config.json, ~/.agent-handoffs/, and harness-specific directories like ~/.codex/ and ~/.claude/.

offload