The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to orchestrate work across multiple child agents, ingesting their outputs to drive subsequent stages of a workflow. This creates a surface where malicious or unexpected output from a child node could influence the orchestrator's logic or the instructions sent to downstream nodes.
Ingestion points: Child node outputs are retrieved through the result.nodes[id].output property in JavaScript/Python eval cells and via handoff files stored in the session directory (e.g., <session-dir>/waves/<run-key>/<node-id>.md).
Boundary markers: The skill enforces a "Node prompt contract" with specific headers like TASK:, DELIVERABLE:, and STOP WHEN:. While these structure the prompts, they do not specifically prevent the agent from obeying instructions embedded within the processed data.
Capability inventory: The skill has the capability to execute shell commands and spawn additional child agents through the tool.workflow tool and eval cells. It also allows for user interaction via the question tool.
Sanitization: There is no explicit requirement mentioned for sanitizing, escaping, or filtering the outputs of child nodes before they are interpolated into subsequent node prompts or used in the orchestrator's control logic.
[DYNAMIC_EXECUTION]: The skill uses dynamic code execution in eval cells as its primary method for defining and driving task graphs.
Evidence: SKILL.md states that the agent should "Build and run every dag INSIDE an eval cell" and provides examples of using JavaScript to dynamically generate nodes based on runtime data (e.g., file globs) and branching on results from previous runs.

mass-ulw