The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to execute several local binaries and scripts, including node, bun, git, and a senpi binary. These executions are necessary for the skill's primary purpose of performing live integration tests, DAG state machine verification, and task delivery QA.
[INDIRECT_PROMPT_INJECTION]: The skill processes and summarizes QA artifacts, README files, and JSON evidence generated by the external senpi binary. This creates a surface for indirect prompt injection if the binary output contains malicious instructions; however, the skill focuses on structured evidence capture and isolation to mitigate risks.
[DATA_EXPOSURE]: The skill interacts with local file paths for evidence storage (.omo/evidence/). It includes a utility script, resolve-evidence-dir.mjs, which serves as a security control by validating input slugs against a strict regex to prevent directory traversal and unauthorized file system access outside the evidence root.

senpi-qa