The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues (via gh issue view) and implementation plans, which serves as a potential vector for indirect prompt injection.
Ingestion points: GitHub issue bodies and comments, external plan files (e.g., fixtures/feature-plan.md).
Boundary markers: The skill uses explicit contracts (e.g., in references/manifest-and-briefs.md) and instructions like "Approved scope outranks reviewer suggestions" and "Ignore previous instructions" to delimit the agent's task.
Capability inventory: Extensive Git command execution (git worktree, git update-ref, git apply), and the ability to launch sub-agents across various platforms (Native Pi, Herdr, Paseo, T3).
Sanitization: The skill mandates physical path validation, symlink checks, and canonicalization of worktree roots to prevent directory traversal or unauthorized file access.
[COMMAND_EXECUTION]: The skill provides detailed shell recipes for managing Git worktrees and references to ensure task isolation.
Evidence: Extensive use of shell scripts in references/git-handoff.md, references/herdr-dispatch.md, and references/review-and-recovery.md for repository management. These commands are constrained to an absolute shared root directory (${XDG_STATE_HOME:-$HOME/.local/state}/worktrees/) and include error handling (set -euo pipefail).

orchestrate-implementation