The Agent Skills Directory

[SAFE]: The skill relies entirely on the Python standard library (such as argparse, json, shlex, math, statistics), avoiding risks associated with unverified third-party dependencies.
[COMMAND_EXECUTION]: scripts/campaign_manager.py generates command templates for simulation runs. It mitigates injection risks by using _validate_command_template to reject shell chaining operators (semicolons, pipes, redirects, backticks) and applying shlex.quote() to all interpolated file paths.
[INDIRECT_PROMPT_INJECTION]: scripts/result_aggregator.py reads external simulation results. It includes protective measures against malicious data, such as a 10 MB file size limit, a maximum JSON nesting depth of 10, and a _sanitize_value function that truncates strings to 500 characters and strips control characters to prevent payload propagation into the agent's context.
[SAFE]: The SKILL.md configuration limits the agent's tool access to Read, Write, Grep, and Glob. It explicitly omits the Bash tool to prevent the agent from executing arbitrary shell commands during the orchestration workflow.

simulation-orchestrator