The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from externally provided tasks, plans, and handover files.
Ingestion points: SKILL.md specifies that the launch prompt provides task IDs, scopes, and absolute paths to plans and handover files which the agent reads directly.
Boundary markers: The instructions lack explicit boundary markers or directions to ignore instructions embedded within the task data.
Capability inventory: The skill is capable of performing repository-wide file reads, git operations (commit, stage), and executing verification commands like builds and tests.
Sanitization: No sanitization or validation logic for the ingested task data is described.
[COMMAND_EXECUTION]: The skill is designed to run arbitrary shell commands for task verification within the local environment.
Evidence: The instructions direct the agent to 'Run the smallest meaningful tests, typecheck, build, or smoke checks required by its acceptance criteria' and 'Run every mutation-capable verification command before the commit.'

worker