The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to ingest and process tasks from multiple external and potentially untrusted sources, creating a surface for indirect prompt injection.
Ingestion points: As described in SKILL.md and references/intake.md, the skill reads tasks from CSV/JSON/YAML files, issue trackers (Jira, GitHub, Linear), markdown checklists, and codebase discovery (globs/package manifests).
Boundary markers: While templates/batch-plan.md provides a template for delegating tasks to workers, it lacks explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded within the task data.
Capability inventory: According to references/execution.md, the executor has the capability to run CLI commands, spawn subagents, modify files (isolated_write, patch_only), and interact with external APIs.
Sanitization: The coordinator is instructed to summarize results, but there is no explicit requirement to sanitize or escape task data before it is interpolated into prompts or executed via CLI.
[COMMAND_EXECUTION]: The skill's primary purpose involves executing arbitrary logic through various harnesses.
The references/execution.md file specifies the use of scripts, local commands, and CLI-backed worker runners to accomplish tasks defined in the input sources. While this is the intended functionality, it relies on the safety of the provided task list.

batch-task-executor