The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files that can influence the instructions given to autonomous sub-agents.
Ingestion points: The skill reads bug reports from production/qa/bugs/*.md and project metadata from project.yaml.
Boundary markers: Absent; external content from bug reports is passed directly to the lead-programmer agent without markers to delimit untrusted instructions.
Capability inventory: The skill possesses the ability to modify the filesystem (via Edit and Write tools used by sub-agents) and execute shell commands via commands.test.
Sanitization: No sanitization or validation is applied to bug report content or project configuration before processing.
[DYNAMIC_EXECUTION]: The skill executes shell commands retrieved from project-level configuration files at runtime.
In Phase 4 and Phase 5, the skill reads the commands.test field from project.yaml and executes it to verify fixes.
If an attacker modifies the project.yaml file, they can achieve arbitrary command execution within the agent's environment.
[COMMAND_EXECUTION]: The workflow relies on spawning specialized sub-agents to perform privileged operations like code modification and testing.
The lead-programmer agent is contextually instructed to generate and apply code fixes based on external bug reports.
The qa-tester and qa-lead agents are empowered to run test suites and validate system behavior.

day-one-patch