The Agent Skills Directory

Indirect Prompt Injection Surface: The orchestrator processes data from sub-agents, including status files like DONE.json and session logs such as transcript.jsonl. If a worker lane processes untrusted content, it could potentially embed malicious instructions in these logs to influence the orchestrator's decisions. (1) Ingestion points: scripts/batch_status.sh and scripts/lane_turns.sh read JSON data from lane worktrees. (2) Boundary markers: The instructions recommend manual verification of verdicts but do not specify programmatic delimiters for interpolated data. (3) Capability inventory: The skill utilizes bash, delegate, and load_skill to act on interpreted statuses. (4) Sanitization: The skill uses jq for structural parsing, ensuring JSON integrity while processing content.
Dynamic Execution Patterns: The launch_lane.sh script generates a temporary bash wrapper in the system's temp directory. This wrapper is used to manage the worker lane's lifecycle, including environment setup and timeout handling, and is executed dynamically.
Automated Command Execution: The skill interacts with the host environment by performing operations such as chmod +x on generated scripts and managing tmux sessions. It also reads the user's global configuration (~/.amplifier/settings.yaml) to validate environment variables before launching worker sessions.

goal-batch