The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses the Bash tool to execute local scripts and the vendor-provided larch.sh CLI for repository operations, session management, and sub-agent orchestration. These actions are standard for software development agents and are governed by detailed internal contracts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issue bodies (plans and feature descriptions). This represents a vulnerability surface for indirect prompt injection.
Ingestion points: GitHub issue content is fetched and stored in $PREFLIGHT_TMPDIR/issue.json and $PREFLIGHT_TMPDIR/plan-from-issue.txt.
Boundary markers: System prompts for coders and auditors use XML-style tags (e.g., <reviewer_plan>) to delimit untrusted content and provide explicit instructions to treat the content as data, not instructions.
Capability inventory: The skill has powerful capabilities (Edit, Write, Bash, Agent) which it uses to implement features. These are protected by architectural invariants and human-in-the-loop checkpoints.
Sanitization: The skill employs scripts/larch.sh redact secrets to scrub API keys, tokens, and other sensitive information from logs and manifests before they are published or committed.

implement