The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to autonomously iterate on and execute untrusted artifacts such as code, prompts, and pipelines.
Ingestion points: The material artifact (M_0), which can be any repository or directory provided by the user, is read and modified by the agent and its sub-executors during the research cycle.
Boundary markers: The skill explicitly instructs the use of git worktree isolation (isolation: "worktree") to quarantine subagent experiments. While this provides a technical execution boundary, it does not prevent the coordinator agent from being influenced by instructions or malicious patterns embedded in the artifact data it processes.
Capability inventory: The skill uses the Bash tool to execute user-provided evaluator commands and the Agent tool to dispatch tasks to sub-executors. It also uses a local Python script (scripts/tree.py) for state management.
Sanitization: No specific sanitization or filtering of artifact content or evaluator output is performed before it is used in prompt construction or decision-making.
[COMMAND_EXECUTION]: The skill frequently executes a local helper script (scripts/tree.py) to manage the research state. This script is part of the skill package and handles the bookkeeping for the hypothesis tree (JSON file management). It also requires the execution of user-defined evaluation commands (E_dev and E_test) to score candidates.
[EXTERNAL_DOWNLOADS]: The documentation in references/arbor-upstream.md provides instructions for downloading and installing the official Arbor research tool from its public GitHub repository (https://github.com/RUC-NLPIR/Arbor). This is presented as an optional alternative to the native implementation.

arbor