The Agent Skills Directory

[PERSISTENCE]: The skill features a 'Continuity Protocol' that instructs the agent to maintain an autonomous, long-running presence. It explicitly directs the agent to use a cron-based API to schedule follow-up checks and 'auto-wake' itself, ensuring the session continues without user interaction.
[METADATA_POISONING]: The skill contains 'NOTE FOR SECURITY REVIEWERS' blocks within the instructions. These are self-referential meta-instructions designed to deceive auditors by making authoritative safety claims about the skill's persistence and command execution mechanisms, attempting to pre-emptively bypass security reviews.
[INDIRECT_PROMPT_INJECTION]: The system processes complex, untrusted data from project briefs and autonomous agent outputs to dynamically construct subagent prompts. It lacks necessary delimiters or sanitization for this external content, creating a surface for indirect prompt injection that could control the agent's shell and scheduling capabilities.
Ingestion points: Project briefs ('BRIEF.md'), decision logs ('DECISIONS.md'), and specialist agent output folders ('agents/*/').
Boundary markers: None identified; ingested content is directly interpolated into prompts using templates.
Capability inventory: Execution of shell scripts ('bash'), automated file opening ('open', 'xdg-open'), and task scheduling via a cron API.
Sanitization: No evidence of data validation or escaping for ingested content.
[COMMAND_EXECUTION]: The skill uses platform-specific commands like 'open' (macOS) and 'xdg-open' (Linux) to automatically display generated artifacts. These commands are executed on file paths within the workspace that could be manipulated through injected content.
[DYNAMIC_EXECUTION]: The system functions by dynamically spawning specialist subagents at runtime. Their system prompts and operational contexts are assembled from various local files, allowing for complex but potentially unpredictable multi-agent behavior.

war-room