The Agent Skills Directory

[COMMAND_EXECUTION]: Instruction 1 executes 'taskmd get $ARGUMENTS' via the shell. This pattern directly interpolates the user-supplied '$ARGUMENTS' variable into a command string. A malicious user could provide input containing command separators (e.g., ';', '&&', '|') to execute unauthorized shell commands.
[REMOTE_CODE_EXECUTION]: The skill is instructed to run arbitrary verification commands such as 'make check', 'build', 'tests', and 'lint' (Instructions 7 and 10). This involves executing code defined within the repository's files, which could lead to arbitrary code execution if the repository contains malicious build scripts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon potentially untrusted data from task files and subagent reports.
Ingestion points: Task descriptions, subtasks, and 'touches' scopes are read from file paths like 'tasks//.md'. Reports and verification results are read from subagent outputs.
Boundary markers: There are no instructions to use delimiters or explicit prompts to ignore instructions embedded within these external files.
Capability inventory: The skill utilizes 'Bash' for command execution, 'Write'/'Edit' for file manipulation, and the 'Agent' tool to initiate subagents.
Sanitization: The skill lacks logic to sanitize or validate the content of task files or subagent reports before using that data to plan workstreams or merge branches.

divide-and-conquer