The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/heartbeat.py executes git rev-parse --show-toplevel via subprocess.check_output to determine the project root. This is a standard operation used to locate the .agent/state/ directory for task management. The command uses a list of arguments and contains no user-controlled input, mitigating shell injection risks.
[PROMPT_INJECTION]: The skill manages a task queue (tasks.json) where task descriptions are processed by the agent, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Task data is read from .agent/state/tasks.json in scripts/heartbeat.py and then printed to standard output for the agent to consume.
Boundary markers: No boundary markers or delimiters are used to separate task data from instructions, allowing untrusted task content to potentially influence agent behavior.
Capability inventory: According to SKILL.md, the agent is expected to fulfill tasks using other available skills (e.g., osint, deep-research), meaning a malicious task description could instruct the agent to use these tools in unauthorized ways.
Sanitization: The skill does not perform any validation or sanitization on the description or outcome fields before they are provided to the agent.

heartbeat