The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a feature called 'measurements' that allows AI planner agents to define arbitrary shell commands in the plan.json file. These commands are executed locally using bash -c within a temporary directory containing a clone of the task's branch. While the script attempts to isolate the environment by allowlisting environment variables and using a scratch HOME directory, it still executes AI-generated command strings on the host machine.
[DYNAMIC_EXECUTION]: The shell commands used for measurements are dynamically authored by the AI planner at runtime based on task requirements. This dynamic generation and subsequent execution of scripts poses a risk if the AI agent's planning logic is compromised or manipulated by malicious input.
[INDIRECT_PROMPT_INJECTION]: In scripts/core/prompts.ts, the skill constructs prompts for downstream agents by interpolating the 'handoff' messages from upstream agents. These handoffs are authored by worker agents and are injected without any delimiters, boundary markers, or specific instructions to the model to ignore embedded commands. This creates a surface where a compromised or malicious worker agent could influence the behavior of descendant agents in the orchestration tree.
[DATA_EXFILTRATION]: The skill facilitating the transfer of local data and files to external services like Slack and the Cursor cloud backend. Although the skill employs comprehensive redaction logic in scripts/core/redact-body.ts and scripts/core/agent-manager.ts to filter out secrets, tokens, and sensitive paths, the core capability of reading workspace files and transmitting them externally presents an inherent risk of data exfiltration if redaction filters are bypassed.

orchestrate