The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/dispatch-agy.py uses subprocess.run, subprocess.Popen, and os.execvp to execute the git and agy CLI tools.
[DYNAMIC_EXECUTION]: The skill dynamically constructs command arguments for the background worker based on content read from external task files located in the .agy-tasks/ directory.
[DYNAMIC_EXECUTION]: The test file tests/test_agy_delegation_contract.py dynamically generates Python script shims and executes them to simulate the agy CLI behavior during regression testing.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and processing instructions from external Markdown files (.agy-tasks/*.md). This creates an attack surface for indirect prompt injection if those files are sourced from or influenced by untrusted parties.
Ingestion points: Files in the .agy-tasks/ directory are read by scripts/dispatch-agy.py and passed to the execution backend.
Boundary markers: The skill provides a template (templates/task-prompt-template.md) to structure these tasks, but it lacks strong delimiters or 'ignore embedded instructions' markers to prevent an attacker from overriding the agent's behavior within a task file.
Capability inventory: The skill has the capability to write files, run tests, and execute arbitrary commands via the agy tool and scripts/dispatch-agy.py.
Sanitization: There is no evidence of sanitization or validation of the content of the task files before they are passed to the execution engine.

agy-delegation-workflow