The Agent Skills Directory

[COMMAND_EXECUTION]: The script compile_deliverables.py constructs shell commands using sh -c and string interpolation of directory paths provided via command-line arguments (--transcripts_dir and --scratch_dir). This pattern allows for command injection if input directory paths contain shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill processes external customer requirement documents (Draw.io diagrams, Cyara XMLs, and source code) to generate natural language transcripts. These artifacts represent an untrusted input surface where malicious instructions could be embedded to manipulate subagent behavior.
Ingestion points: Files located in the source_dir tree, analyzed by specialized ingestors.
Boundary markers: Prompts lack explicit instructions for subagents to ignore instructions embedded within the source artifacts.
Capability inventory: The agent has the ability to execute shell commands (via compile_deliverables.py) and write files to the workspace.
Sanitization: Input content is not sanitized beyond standard YAML parsing.
[DYNAMIC_EXECUTION]: The skill instructions in SKILL.md authorize the agent to autonomously research unknown file formats and 'codify a new ingestor skill' or 'create a new specialized skill'. This allows the agent to dynamically extend its own logic based on information gathered from external, potentially untrusted sources.

cxas-cuj-report-generator