The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements 'Arena' and 'Swarm' workflows where a parent agent ingests and aggregates responses from multiple parallel sub-agents (candidates or workers). This design creates an attack surface where a sub-agent could return output containing instructions designed to hijack the parent agent during the synthesis or reporting phases.
Ingestion points: The agent is instructed to read candidate rationales/artifacts in references/arena/arena.md (Phases D and E) and worker results/evidence in references/swarm/swarm.md (Phase C).
Boundary markers: The skill includes defensive instructions such as "Do not paste raw worker dumps," "read every candidate end to end before picking," and "score each against the rubric criterion by criterion, not on holistic feel."
Capability inventory: The parent agent can spawn sub-agents, create file system structures (git worktrees, /tmp), and execute writes within the task scope.
Sanitization: No explicit programmatic sanitization is defined; the skill relies on the LLM's adherence to the provided 'verification' and 'rubric-based' evaluation instructions to filter malicious content.
[COMMAND_EXECUTION]: The instructions require the agent to manage the local file system to ensure output isolation for sub-agents.
Evidence: references/arena/arena.md (Phase A) directs the agent to "Give each candidate its own output location (a git worktree where possible, otherwise /tmp/arena-/candidate-/)."
Evidence: references/swarm/swarm.md (Phase B) instructs the agent to "Schedule within its capacity, preserving each worker's independent output location."

team-up