The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute local CLI utilities for core functionality. Evidence includes executing node ~/lev/workshop/poc/lookup/cli.js for skill discovery in dispatch/skill-injection.md and references/power-combos.md. It also invokes lev-skills, codex, and bd for model dispatch and task tracking as described in dispatch/multi-model.md and engine/synthesis-protocol.md.
[INDIRECT_PROMPT_INJECTION]: The skill implements a recursive multi-agent deliberation loop where a synthesizer agent processes markdown artifacts produced by previous agent turns. This design creates a vulnerability surface where malicious content generated by one agent could influence the synthesizer's behavior or subsequent turn directives.
Ingestion points: The synthesis agent reads Turn N artifacts from disk (tmp/cdo-{session}/t{N}-{role}.md) as specified in SKILL.md and engine/synthesis-protocol.md.
Boundary markers: The framework uses YAML blocks and Markdown headers for structure but lacks explicit instructions to the synthesizer to ignore or sanitize embedded instructions within the ingested agent outputs.
Capability inventory: The skill has broad capabilities including Agent, SendMessage, and Bash tool access across its various scripts.
Sanitization: No explicit sanitization, escaping, or validation of the agent-generated artifacts is performed before they are processed by the synthesis agent.
[DATA_EXFILTRATION]: In SKILL.md, there is a hardcoded absolute file path: /Users/jean-patricksmith/.agents/skills/cdo/SKILL.md. This exposes a specific local username and system structure, which constitutes minor data exposure.
[DYNAMIC_EXECUTION]: The skill dynamically determines its execution path using flow definitions and programmatic agent spawning. It resolves logic to exec --flow plugins/cdo/flows/cdo-adaptive-deliberation.flow.yaml and uses the Agent tool to spawn child agents based on runtime synthesis directives, as detailed in SKILL.md and dispatch/team-mode.md.

cdo