The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill maintains an extensive attack surface for indirect injection as it processes data from external task trackers (Jira) and multiple autonomous workers.
Ingestion points: Untrusted data enters the agent context through docs/swarm/queue-state.yaml and docs/swarm/blockers.yaml (updated from worker returns and external issue reads).
Boundary markers: The skill uses strict JSON schema validation for all worker returns (e.g., worker-terminal.schema.json) and enforces SHA-256 digest integrity for every state transition.
Capability inventory: The skill possesses subprocess execution capabilities through scripts/verification_evidence.py to run verification suites.
Sanitization: External data is sanitized before use; shell commands are parsed with shlex.split, and scripts/worker_contract.py explicitly blacklists shell meta-characters (;, &&, |, etc.) and prevents directory traversal.
[COMMAND_EXECUTION]: The skill uses shell commands for repository orchestration and task verification. scripts/capture_worker_observation.py executes Git commands to derive diffs, and scripts/verification_evidence.py executes user-defined verification argv. These commands are gated by an orchestrator-level approval process defined in references/documentary-planning.md.
[DYNAMIC_EXECUTION]: The skill assembles and executes command lists at runtime based on worker contracts and wave plans. This dynamic execution is mitigated by a content-addressable model where every contract is bound to a specific SHA-256 hash, ensuring the instructions cannot be altered after materialization.

krt-swarm-seneschal