The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to execute a shell command to run a Python script for cost calculations.
Evidence: In references/operations.md, the instructions state: Run python3 cost_receipt.py INPUT.json [--pricing PATH] using the installed calculator path above.
[DYNAMIC_EXECUTION]: The script targeted for execution is located outside the skill's defined directory structure using path traversal (../../../), making it unverifiable and potentially unsafe.
Evidence: references/operations.md defines the script path as [calculator](../../../scripts/cost_receipt.py) and the pricing data as [pricing snapshot](../../../pricing/2026-09-04.json).
[PROMPT_INJECTION]: The instructions command the agent to assume a specific identity ("GPT-6 Astra") and provide conditional logic to override its actual system metadata, which is a form of persona-based prompt injection.
Evidence: SKILL.md states: If observable runtime metadata says the parent model is not gpt-6-astra, report the mismatch as a selection prerequisite and do not claim Astra orchestration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external subagents and file diffs without specifying sanitization methods, creating a vulnerability surface for indirect instructions.
Ingestion points: Processes subagent outputs and code diffs as described in references/operations.md.
Boundary markers: Uses text-based formatting patterns like ASTRA REVIEW to structure output but lacks explicit instructions to ignore or neutralize embedded commands within the input data.
Capability inventory: The skill possesses the ability to execute shell commands and manage multiple subagent sessions.
Sanitization: There is no evidence of data sanitization, validation, or escaping before processing external inputs.

orchestration