The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The agent processes instructions from external evaluation reports to generate and execute fix tasks, creating a surface for indirect injection if the reports contain untrusted content.
Ingestion points: Step 1 involves reading evaluation reports (e.g., loop-plan-evaluator or loop-execution-evaluator output).
Capability inventory: The agent has permissions to read/write files (plan.md, metadata.json), modify source code, and execute build processes.
Boundary markers: There are no explicit instructions for the agent to sanitize or treat report content as untrusted; it directly converts instructions into actionable tasks.
Sanitization: No validation or escaping of the extracted fix instructions is mentioned.
[COMMAND_EXECUTION]: The skill involves the execution of project-specific commands to implement and verify code changes.
Evidence: Step 3 ("Implement the fix") and Step 4 ("Verify Fixes Locally") require the agent to modify code and run build/test commands to confirm the fixes work as intended.
[PROMPT_INJECTION]: The instructions contain directives that encourage the agent to operate autonomously by bypassing user confirmation.
Evidence: The skill explicitly states "NEVER ask user" in multiple places, specifically regarding the handling of the fix cycle limit (e.g., "if still failing after 5 rounds, mark track as completed-with-warnings (NEVER ask user)"). This reduces human oversight in the automated loop.

loop-fixer