The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which is then interpolated into prompts for subagents, creating a vulnerability to indirect prompt injection.
Ingestion points: Data enters the agent's context through user-provided briefs (SKILL.md) and multiple manual QA channels including HTTP response bodies, browser content, and terminal outputs (references/full-workflow.md).
Boundary markers: While the skill uses a TASK: prefix to structure subagent prompts, it lacks formal delimiters or specific instructions to ignore malicious content embedded within the ingested data.
Capability inventory: The skill utilizes the task tool to spawn subagents, the omo-agent-toolkit CLI for state management, and standard utilities such as Git, curl, and tmux.
Sanitization: There is no mention of sanitizing or escaping the 'evidence' data before it is recorded in the ledger or passed to subagents.
[COMMAND_EXECUTION]: The skill performs extensive shell command execution for repository management (Git), network interaction (curl), and process orchestration (tmux, kill).
[DYNAMIC_EXECUTION]: The skill dynamically generates instructions and context for subagents (omo-senpi) at runtime using the task and workflow tools.
[EXTERNAL_DOWNLOADS]: The skill references and utilizes well-known external dependencies and tools including playwright-core and the vitest test runner for automated verification and quality assurance.

ulw-loop