The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions explicitly direct the agent to prioritize content from an external file (AGENTS.md) over the skill's own defined rules. This creates a vulnerability where malicious or conflicting instructions placed in the repository could override the agent's intended behavior.
Ingestion points: AGENTS.md, references/<project>.md, and the src/changelog.js file.
Boundary markers: No specific delimiters or warnings are provided to the agent to treat instructions within these files as data rather than commands.
Capability inventory: The skill possesses significant capabilities including managing other agent sessions (send_message, archive_session), executing shell scripts, and performing Git operations.
Sanitization: There is no evidence of sanitization or validation of the instructions read from the repository files before they are adopted by the agent.
[COMMAND_EXECUTION]: The skill utilizes several Python and Shell scripts to interact with the local operating system and Git environment.
The scripts audit-changelog.py and contact-sheet.py invoke git via subprocess.run to inspect repository history and state.
repo-status.sh and save-captures.sh execute various shell utilities including git, rsync, awk, and stat to manage worktrees and screenshot archives.
[EXTERNAL_DOWNLOADS]: The live-check.sh script performs network requests to external domains using curl.
It fetches a user-specified or environment-defined URL and automatically parses the response to identify and download up to 8 linked assets (such as images or scripts) to verify their availability.

workflow-threads-manager