The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection by fetching data from external, potentially attacker-controlled sources and using it to guide agent behavior.
Ingestion points: The ao_issues tool retrieves external issue descriptions from a tracker (e.g., GitHub), and ao_review_check retrieves PR review comments. This content is then provided as context or instructions to coding agents spawned via ao_spawn.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to separate untrusted issue/comment content from the agent's core instructions.
Capability inventory: The skill has the capability to spawn autonomous agents that can modify code, create git worktrees, and interact with repository history. It also allows sending arbitrary text commands to running agents via ao_send.
Sanitization: There is no explicit mention of sanitization or validation logic to filter out malicious instructions embedded in the external issue or comment data before it reaches the execution agents.

agent-orchestrator