The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a verification gate (Step 4) that executes 'oracles'—shell commands such as grep, git operations, or running the application itself. These commands are dynamically constructed based on findings discovered by sub-agents. Because these sub-agents process untrusted code from the repository, there is a risk that maliciously crafted content in the repository could influence the generation of these commands, leading to unauthorized command execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the local repository through its sub-agent architecture.
Ingestion points: Sub-agents ingest repository content using tools like grep and read during the discovery phase (SKILL.md Step 2).
Boundary markers: The skill attempts to mitigate risks by instructing sub-agents to remain 'blind' to other results and requiring them to return data within fenced JSON blocks (SKILL.md Step 3).
Capability inventory: The orchestrator can execute shell commands via 'oracles' and has access to the terminal tool, while sub-agents can read files and search the repository.
Sanitization: The skill uses a structured JSON I/O contract and schema validation to handle data returned by sub-agents, which provides a layer of protection against malformed or malicious payloads.

work-sweep