The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to invoke external command-line interface (CLI) tools, including codex, cursor-agent, and grok. These tools are executed in a background shell to 'dispatch' work to other AI agents.
[DYNAMIC_EXECUTION]: The skill involves runtime generation of executable-like content. It writes a 'builder block' to docs/builder-block.md which contains instructions and specifications. This generated file is then immediately used as input for the shell commands mentioned above.
[INDIRECT_PROMPT_INJECTION]: The skill implements a feedback loop that ingests data from docs/HANDOFF.md. This file is designed to be updated by an external 'Builder' agent (e.g., GPT-5.5 or Grok). Because the Architect agent (the one using this skill) rules on the Builder's 'disagreements' and uses the file's state to generate subsequent shell commands, a malicious or compromised Builder could inject data that influences the Architect's future actions or the content of the commands it executes.
Ingestion points: docs/HANDOFF.md is read at the start of every session to extract state, disagreements, and results.
Boundary markers: None identified; the skill treats the content of the handoff file as authoritative 'memory'.
Capability inventory: The skill has the capability to execute shell commands (codex exec, cursor-agent, grok) and write to the filesystem (docs/HANDOFF.md, docs/builder-block.md, .git/info/exclude).
Sanitization: There is no explicit sanitization or validation of the text read from docs/HANDOFF.md before it is incorporated into the next slice spec or builder block.
[COMMAND_EXECUTION]: The builder profile for 'cursor' in references/builder-profiles.md defines a dispatch command: cursor-agent -p --model <model> "$(cat docs/builder-block.md)". This specific pattern uses shell sub-shell expansion ($(...)) to pass the entire contents of a file as a command-line argument. If the content of docs/builder-block.md (which includes data from the untrusted Builder) contains shell metacharacters like backticks, semicolons, or pipe symbols, it could lead to arbitrary command injection on the host system.

architect-loop