The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a runtime loading pattern where it retrieves a list of skill names from an external "work ledger" via the plan read command and proceeds to invoke each one using Skill(skill="{skill-name}"). Because the source of these skill names is a remote data store, this mechanism allows for the activation of arbitrary capabilities if the ledger contains untrusted or malicious entries.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its ingestion of untrusted data from multiple external sources.
Ingestion points: The agent reads task titles, requirements, constraints, acceptance criteria, and verification steps from the work ledger (plan read). It also fetches architect specs and feature context from an artifact manifest (artifact read).
Boundary markers: The instructions lack delimiters or explicit warnings to the agent to treat these external inputs as data only, increasing the risk that the agent may interpret embedded instructions as commands.
Capability inventory: The skill has powerful capabilities, including the ability to execute shell commands via sam_cli and the ability to extend its own functionality through dynamic skill loading.
Sanitization: There is no evidence of validation, filtering, or escaping of the content retrieved from the ledger or artifacts before it is incorporated into the agent's context.
[COMMAND_EXECUTION]: The skill relies heavily on the sam_cli tool to interact with the environment, performing operations such as reading files, updating task statuses, and managing session context. While these are intended functions, the interface provides a powerful execution vector that could be exploited if the agent's logic is subverted by malicious task data.

start-task