The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that attempt to bypass human oversight. Specifically, the cron job definition includes the instruction "Do NOT ping human
fix issues yourself," which encourages the agent to operate autonomously without user verification or intervention when encountering errors.
[PERSISTENCE]: The skill establishes persistence by configuring a recurring cron job ("cron action:add"). This ensures the orchestration and self-healing logic continue to execute periodically across different agent sessions without manual re-triggering.
[COMMAND_EXECUTION]: The skill relies on tmux send-keys to execute commands in background sessions. This method of command delivery can be used to run arbitrary shell instructions that are difficult for the user to monitor in real-time.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external, untrusted data.
Ingestion points: The orchestrator fetches untrusted content from GitHub issue titles and bodies (gh issue list) and reads captured shell output from tmux panes (tmux capture-pane).
Boundary markers: The skill does not implement delimiters or specific instructions to ignore embedded commands within the ingested issue content.
Capability inventory: The orchestrator has extensive permissions, including exec (git, tmux, gh, codex) and file_write access to the project directory.
Sanitization: No sanitization or validation is performed on the data fetched from GitHub issues before it is used to generate prompts for the autonomous codex tool.
[DYNAMIC_EXECUTION]: The skill employs the codex tool with the --yolo flag for autonomous code generation and execution. This configuration instructs the agent to execute AI-generated code and shell commands automatically, which represents a high-risk dynamic execution pattern if the input prompts are influenced by untrusted data.

task-orchestrator