The Agent Skills Directory

[COMMAND_EXECUTION]: The skill manages worker execution via a specialized runner script (scripts/codex-worker.sh) that invokes the codex CLI tool.
Evidence: The script implements rigorous controls including environment variable filtering (env -i), process group management to ensure full cleanup of sub-processes, and exclusive workspace locks to prevent race conditions during write operations.
Security Controls: The execution logic includes specific checks to prevent path hijacking by verifying the helper's resolution path and rejecting helpers located within the session repository under review.
[INDIRECT_PROMPT_INJECTION]: The delegation framework has an inherent surface for indirect prompt injection as it processes tasks and repo context to brief worker agents.
Ingestion points: Task descriptions provided via the /orchestrate command and general repository state.
Boundary markers: The skill instructions in SKILL.md define a clear structure for dispatch (labels and headers) and explicitly warn about the potential for workers to inherit uninspected instructions from their environment.
Capability inventory: The delegation mechanism allows workers to write to isolated worktrees (workspace-write) and spawn sub-processes via shell commands.
Sanitization and Mitigations: The skill enforces the use of JSON Schema for worker outputs, mandatory human review of all worker-generated diffs, and explicit boundary instructions regarding secrets and credential handling.

orchestrate