The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, including branch instructions, task results, and pull request listings (e.g., in SKILL.md and references/herdr.md). This ingestion creates a surface for indirect prompt injection. However, the skill explicitly mitigates this risk by requiring an independent verifier for every unit of work and stating that worker claims are untrusted.
Ingestion points: SKILL.md (reading task instructions), references/herdr.md (reading pane output via herdr pane read).
Capabilities: File writing and command execution through associated owner skills (e.g., skill://coder).
Sanitization: The skill mandates a three-step 'Execute -> Verify -> Accept' sequence where the verifier is a separate operation from the worker dispatch.
[COMMAND_EXECUTION]: The evaluation scripts (e.g., evals/run_trials.py, evals/test_agent_grader.py, and evals/sample_host.py) utilize Python's subprocess module to execute the agent CLI and test fixtures. These scripts are used for development and testing of the skill and are not executed by the AI agent during typical use. The fixtures employ macos-sandbox-exec to further restrict the impact of these executions.
[DYNAMIC_EXECUTION]: The test environment's mock MCP server (evals/sample_mcp.py) dynamically loads orchestration mode configurations using importlib.util. This is a standard design for the included testing framework and is restricted to loading local project files (ORCH_MODE.py).

orch