The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands defined in the measurement.command field of the user-provided optimization spec. This execution occurs within the scripts/measure.sh runner.
[CREDENTIALS_UNSAFE]: The scripts/experiment-worktree.sh script automatically copies all .env files from the repository root into isolated experiment worktrees. This exposes sensitive environment variables, such as API keys and database credentials, to subagents (experiment workers) and the measurement harness.
[DYNAMIC_EXECUTION]: The skill generates and implements code changes using AI subagents (workers) or codex exec, and then executes the modified code to evaluate performance. This involves running code that is dynamically generated during the optimization process.
[INDIRECT_PROMPT_INJECTION]: The LLM-as-judge mechanism (defined in references/judge-prompt-template.md) ingests output generated by the system being optimized. This untrusted data is interpolated into the judge agent's prompt, creating a surface where malicious output could influence the judge's scoring or feedback.
Ingestion points: The {items_json} variable in the references/judge-prompt-template.md file.
Boundary markers: Content is delimited by <items> tags, but lacks specific escaping or instructions for the model to ignore embedded commands.
Capability inventory: The judge agent is designed to return structured JSON; while it lacks direct tool access, its evaluations drive the orchestrator's decisions and future hypotheses.
Sanitization: There is no documented sanitization or filtering of the external content before it is processed by the judge.

ce-optimize