The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from AI agents, such as task specifications, code reviews, and test plans. This represents an indirect prompt injection surface.
Ingestion points include TASK.md (via execute in driver.py), review.md (via parse_findings in c1b.py/chain_controller.py), and qa-plan.md (via planned_commands in c1b.py).
The risk is mitigated by explicit instructions in prompts (e.g., prompts/judge.md) to ignore instructions within evidence and the use of regex-based parsing to isolate findings.
Capabilities include Git worktree management, local file writes, and execution of automated tests (limited to python, node, npm).
Input validation includes strict regex matching for finding severities and shlex.split for command parsing to prevent shell injection.
[COMMAND_EXECUTION]: The skill executes automated tests and Git commands to manage worktrees and verify implementation quality.
The skill uses subprocess to run git, python, node, and npm as seen in scripts/driver.py and scripts/findings.py.
Command execution is restricted to a whitelist of tools and lacks shell interpolation, mitigating the risk of arbitrary command injection.
[DATA_EXFILTRATION]: The skill sends code diffs, tickets, and test observations to an external judgment service.
Network requests are made to api.typesafe.ai in scripts/arbiter.py as part of the intended arbitration and quality assurance workflow.
The skill implements credential isolation for the TYPESAFE_API_KEY using the isolated_key context manager to prevent accidental exposure to model contexts or child processes.

ticket-driver