The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external repository content and task-specific prompt files, creating an inherent attack surface for indirect prompt injection.
Ingestion points: The worker agent ingests content from the target repository and the task file specified via the --prompt-file argument in scripts/run_luna_worker.py.
Boundary markers: The skill instructs the commander to use structured text headers (Role, Objective, Constraints, Done when) to delimit context in task files.
Capability inventory: The skill can execute shell commands via the codex CLI and perform file operations within the specified sandbox.
Sanitization: The skill enforces --strict-config for the worker and provides a read-only sandbox with isolated cache directories for review tasks to mitigate unauthorized modifications.
[COMMAND_EXECUTION]: The skill invokes external CLI tools to manage the worker lifecycle and repository state.
Evidence: scripts/run_luna_worker.py uses subprocess.Popen to call the codex executable and subprocess.run to call git.
Mitigation: Command arguments are passed as lists rather than strings, avoiding shell interpolation risks. The script also validates that the codex binary is a regular file with execution permissions.
[DATA_EXFILTRATION]: The skill records operational telemetry to a local ledger.
Evidence: scripts/run_luna_worker.py appends JSON records to $CODEX_HOME/state/sol-luna-router/runs.jsonl.
Mitigation: The implementation explicitly excludes sensitive data such as prompt text, response bodies, and raw error messages from the logs. It enforces restrictive file permissions (0600) and directory permissions (0700) to ensure only the user can access the telemetry.

sol-luna-router