The Agent Skills Directory

[METADATA_POISONING]: The skill references a non-existent model version gpt-5.6-terra for routing delegated tasks. Fictitious model names can mislead the agent regarding its capabilities or cause operational failures when runtime checks verify the model identity.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content and interpolates it into instructions for child agents (the 'Worker packet'), creating a vulnerability surface for instruction confusion.
Ingestion points: The agent is instructed to read repository state, path details, test results, and reports from the codebase (SKILL.md).
Boundary markers: The 'Worker packet' template lacks specific delimiters or clear instructions to treat repository data as untrusted text rather than executable instructions.
Capability inventory: The skill utilizes high-impact capabilities including repository mutation via Git operations (branching, merging, PR creation) and the execution of build/test commands (SKILL.md).
Sanitization: No evidence of sanitization or filtering for data read from the repository.
[COMMAND_EXECUTION]: The advisor workflow requires the root agent to execute build and validation commands to verify worker contributions. While standard for engineering tasks, this capability is exposed to the identified indirect injection surface.

engineering-advisor