The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possess a surface for indirect prompt injection as it incorporates external data from local feature specifications and lesson files into the instructions provided to spawned sub-agents.\n * Ingestion points: Data is read from lessons-learned/ markdown files and feature specifications provided in the dispatch brief (SKILL.md).\n * Boundary markers: Injected content is organized under markdown headers such as ## Prior Lessons but lacks strict isolation delimiters or specific instructions for the agent to ignore potentially malicious embedded content (SKILL.md).\n * Capability inventory: Spawned agents have full tool access to perform file system writes, shell execution, and git operations within the created worktree (SKILL.md).\n * Sanitization: The skill employs machine-driven assembly of the bootstrap prompt to prevent hallucination-based drift, although it does not explicitly sanitize the content of the ingested data files (SKILL.md).\n- [DYNAMIC_EXECUTION]: The skill dynamically assembles bootstrap prompts at runtime and executes them by spawning new agent processes or background tasks across various host backends like Claude, Codex, and tmux (SKILL.md). This is a core functional requirement of the orchestration logic designed to initiate autonomous implementation workflows.\n- [EXTERNAL_DOWNLOADS]: The documentation and setup guides reference official engineering guidelines hosted by Anthropic (references/evaluator.md). As a trusted organization, these references are considered safe and informative.\n- [COMMAND_EXECUTION]: The skill utilizes shell and git commands to manage the lifecycle of feature worktrees, verify repository status, and probe for sub-agent liveness (SKILL.md, references/orphan-recovery.md). These operations are confined to the local project directory and are protected by clean-state invariants to prevent accidental data modification.

aep-launch