The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The delegated rulecheck-agent is designed to read and enforce rules from project files like AGENTS.md. This creates a surface for indirect prompt injection, where an attacker who can modify these project files could influence the agent's autonomous actions, such as code edits and pull request creation.
Ingestion points: AGENTS.md, .archon/engineering.md (read by the delegated agent).
Boundary markers: Not explicitly defined in the provided orchestrator instructions.
Capability inventory: The agent can perform file system edits, execute validation scripts, and create pull requests on GitHub.
Sanitization: No evidence of content validation or escaping for the rules being processed.
[COMMAND_EXECUTION]: The hooks/block-dangerous.sh script implements a safety gate to block high-risk shell commands. However, the filters rely on simple regular expressions (e.g., checking for rm -rf / while excluding lines containing node_modules) that can be bypassed using shell comments or concatenated commands (e.g., rm -rf /; # node_modules).
[EXTERNAL_DOWNLOADS]: The hooks/slack-notify.sh hook uses curl to send agent run summaries to an external Slack webhook. While the webhook URL is intended to be provided by the user via environment variables, this represents an outbound network capability that transmits data about the codebase and agent activities.

rulecheck