The Agent Skills Directory

[PROMPT_INJECTION]: The "Skill Isolation" section contains explicit override instructions, claiming the skill is the "sole active authority" and directing the agent to "suppress" any other skills that attempt to activate spontaneously. This is a pattern used to bypass platform-level safety and orchestration constraints.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core workflow of processing data from external AI colleagues.
Ingestion points: The agent reads untrusted data from rounds/round-NN/agent-1-output.md, rounds/round-NN/agent-2-output.md, and task.md.
Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings when the coordinator agent reads these files.
Capability inventory: The coordinator has access to shell execution (assets/pair-colleague.sh), file system write operations (record-decision, finalize), and process management (reap).
Sanitization: There is no mention of sanitizing, escaping, or validating the ingested agent outputs before they are processed by the coordinator.
[COMMAND_EXECUTION]: The skill requires the execution of multiple local shell scripts (assets/pair-colleague.sh, assets/run-agent.sh) to manage the multi-agent session. The resolution logic for these scripts searches multiple paths, including $HOME and the current working directory, which could lead to the execution of unintended binaries if the environment is compromised.

pair-colleague