The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because its core workflow involves reading and executing instructions from external files (.agents/operator/jobs/*.md).
Ingestion points: The agent reads job files from the .agents/operator/jobs/ directory as its primary source of instructions for the 'Operator' role.
Boundary markers: The skill uses structured templates for jobs and reports, but it does not implement explicit 'ignore embedded instructions' delimiters or boundary markers when interpolating job content into the agent's context.
Capability inventory: The 'Operator' role has significant capabilities, including driving a real desktop and browser via computer-use tools, performing file system writes for code implementations, and executing shell commands in the preamble.
Sanitization: There is no evidence of sanitization or filtering of the job file content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill includes a bash preamble in SKILL.md that the agent is instructed to execute to determine its role and job status. This script performs local file system operations (find, grep, sed, git) to manage job IDs and reports. While the script is used for legitimate orchestration and does not access sensitive user data or external networks, it represents a routine use of shell execution within the skill's workflow.

operator-handoff