The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest user requests and existing project code to generate implementation specifications for sub-agents. This workflow creates an attack surface where malicious instructions embedded in the code being analyzed could influence the planning or verification phases.
Ingestion points: The skill instructions specify that the lead must 'inspect the request and relevant code' (SKILL.md) and the executor must 'read every listed skill' (SKILL.md).
Boundary markers: The skill attempts to mitigate risks by using a 'bounded scope' and defined text contracts for OBJECTIVE, FILES, and INTERFACES, though these are not cryptographic or strictly enforced safety boundaries.
Capability inventory: The agents are granted capabilities to edit files, persist artifacts, and execute shell commands for inspection and verification (SKILL.md).
Sanitization: No explicit sanitization or escaping of external content is mentioned before interpolation into sub-agent specifications.
[COMMAND_EXECUTION]: The workflow explicitly permits and encourages the use of shell commands for 'read-only inspection' and 'verification' (SKILL.md). The skill acknowledges that shell access can potentially bypass platform-level tool restrictions, posing a risk if the agent is misled into executing unintended commands.

orchestrating-fusion