The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted user tasks and conversation context. \n- Ingestion points: User requests and codebase files are read in SKILL.md Step 2 to create the task brief. \n- Boundary markers: Uses === THE TASK === markers, which reduce but do not eliminate the risk of the agent following instructions embedded in the data. \n- Capability inventory: Spawns sub-agents via the Agent tool and instructs judges to execute code in scratch directories. \n- Sanitization: No sanitization or escaping of task data is performed before prompt interpolation. \n- [COMMAND_EXECUTION]: The skill instructs the agent to run a provided local script (bracket.py) to manage tournament logic and state. \n- [DYNAMIC_EXECUTION]: The Judge sub-agent prompt template explicitly encourages runtime code execution to verify attacks ('If the task is code and running something settles an attack, do it'), creating a surface for executing potentially malicious logic derived from the task.

arena