The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and processes plan files from the repository (.omo/plans/*.md) to drive subagent behaviors. Malicious instructions placed in these files by an untrusted actor could hijack the orchestration workflow.\n
Ingestion points: The skill ingests content from .omo/plans/*.md and .omo/boulder.json to determine task logic and subagent messages.\n
Boundary markers: The skill uses structured formatting (e.g., TASK, DELIVERABLE, SCOPE, VERIFY) to wrap subagent instructions, providing a degree of separation but no formal security boundary.\n
Capability inventory: The skill has the capability to spawn subagents (spawn_agent), perform git worktree operations, execute network requests via curl, and drive browser automation tools.\n
Sanitization: There is no evidence of explicit validation or sanitization applied to the content of the plan files before it is interpolated into agent instructions.\n- [COMMAND_EXECUTION]: The skill automates significant system and network operations through its subagents, including git worktree management and the use of curl for endpoint testing and verification.\n- [EXTERNAL_DOWNLOADS]: The skill references the agent-browser repository from Vercel Labs as a tool for browser-based Quality Assurance. This is a well-known service and the reference is documented as part of the intended verification workflow.

start-work