The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality relies on processing output from independent 'proposer' agents. These agents are provided with a 'packet' containing user-supplied tasks and file contents, creating an attack surface where a compromised or malicious proposer can influence the aggregator agent.\n
Ingestion points: The skill collects responses from multiple agents in Step 4 and Step 5 of SKILL.md.\n
Boundary markers: While the aggregator prompts in references/prompts.md use model-based labeling (e.g., '[{model}] {response}'), they do not include robust sanitization or specific instructions to ignore embedded commands within the proposer's output.\n
Capability inventory: The aggregator has the ability to apply git diffs, execute project-specific tests, and spawn further agents.\n
Sanitization: No sanitization is performed on the proposer-generated text or diffs before they are processed or executed.\n- [COMMAND_EXECUTION]: In the 'pick' mode described in SKILL.md (Step 5), the agent is instructed to apply unified diffs and execute shell commands for testing, linting, and typechecking. This automated execution of commands based on external input allows for potential subversion of the local environment.\n- [DYNAMIC_EXECUTION]: The skill automates the execution of code generated at runtime by proposers. If a proposer produces a malicious patch, the aggregator's automated validation step (running project tests) would execute that code, potentially leading to unauthorized filesystem access or network exfiltration within the test context.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes platform-specific tools (delegate_task, Agent, spawn_agent) to communicate with external model providers such as Grok, OpenAI, and Anthropic. This is inherent to the MoA design but involves network-based delegation to third-party services.

moa