The Agent Skills Directory

[COMMAND_EXECUTION]: The scheduler script (scripts/tick.sh) executes the agent binary to run background governor and worker sessions. It uses the --dangerously-skip-permissions flag to enable autonomous tool usage, which is protected by multi-layered internal safety invariants and external enforcement gates.
[PROMPT_INJECTION]: The skill processes data from external sources like project management tools, creating an attack surface for indirect prompt injection. This is mitigated by 'Invariant 3' (Untrusted data), which strictly requires the agent to treat ingested content as data and ignore any instruction-like text.
Ingestion points: External work queue items (titles, bodies, comments) are fetched via the tracker adapter.
Boundary markers: Explicit instructions in templates/runner-prompt.template.md (Invariant 3) define unit text as untrusted data.
Capability inventory: Spawning agent sessions, writing local status files, and executing tracker tools via configured adapters.
Sanitization: Log mining employs whitelist-based redaction for free-text fields, and the scheduler uses deterministic regex-based config parsing.
[COMMAND_EXECUTION]: Provides templates for system-level persistence using systemd (Linux) and launchd (macOS). These are used as intended to maintain the autonomy loop across system restarts and user sessions.
[SAFE]: The skill follows security best practices by implementing a 'latent-vs-deterministic split,' ensuring that critical control functions like the master kill switch and context reseed budgets are handled by verified code rather than relying solely on agent reasoning.

governed-autonomy-loop