The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external "channels", "inboxes", and "signals" (e.g., CI logs, user messages) to determine its tasks. This represents a significant surface for indirect prompt injection where malicious instructions could be embedded in the data being processed.
Ingestion points: SKILL.md and references/entry.md describe reading from posed_to vimarshas, "signals" (human word, agent word, reality events like CI logs), and the "inbox".
Boundary markers: The skill mentions statuses and internal tracking (e.g., "anagata", "vartamana"), but lacks explicit delimiters or "ignore embedded instructions" warnings for processing external signals.
Capability inventory: The skill modifies repository files, opens/merges PRs via git and gh, and delegates code execution to sub-agents as described in references/integration.md and SKILL.md.
Sanitization: There is no evidence of escaping, validation, or filtering of external content before it influences the agent's logic.
[COMMAND_EXECUTION]: The skill is designed to perform repository management operations including git, gh (GitHub CLI), and fj (Forgejo) commands. It manages branches, commits, PRs, and merging processes. While this is the intended purpose for managing the "watch" (vahta), it involves high-privilege operations on the source code repository.
[DYNAMIC_EXECUTION]: The skill utilizes "sub-agents" to perform specific tasks such as "code execution", "review", and "verification". It generates "briefs" (instructions) for these sub-agents based on the current context and signals. This creates a multi-step execution chain where dynamically generated instructions lead to code execution and system changes.

vahta