The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/lib/momo_worker_monitor.py uses subprocess.Popen to execute a command specified by the --dispatch argument. This allows for arbitrary command execution whenever a worker heartbeat fails or a retry is triggered.
[DYNAMIC_EXECUTION]: The scripts/momo-board.sh script dynamically sources a shell script (ticket-provider.sh) using a path constructed from the role_dir field in the repo's .project.json file. Similarly, scripts/lib/momo_lane_gate.py executes sentinel scripts from paths derived from the project structure.
[CREDENTIALS_UNSAFE]: The skill is designed to handle sensitive API keys for Plane and Trello. scripts/momo-board.sh specifically searches for Plane API keys in ~/.hermes/fleet.env or a path provided by the HERMES_FLEET_ENV environment variable.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with ticket provider APIs, including https://plane.delo.sh and https://api.trello.com/1. It also publishes decision events to a NATS bus using a publisher located in the BLOODBANK_HOME directory.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it fetches and processes ticket titles, descriptions, and comments from external boards.
Ingestion points: Untrusted data enters the agent context via momo-board.sh (Plane/Trello API calls).
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore malicious content embedded within ticket data.
Capability inventory: The agent can execute shell commands, write to the file system, and perform network operations.
Sanitization: There is no evidence of sanitization or filtering of the ingested ticket data before it is used to drive PM logic.

momo