The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to process untrusted external data such as stories, issues, and repository rules (Ingestion Points: SKILL.md, Step 1). It mitigates the risk of indirect prompt injection by providing sub-agents with specific worker briefs that mandate treating all input as data rather than instructions and requiring them to flag any 'instruction-shaped' text (Boundary Markers/Sanitization: references/briefs.md). The sub-agents operate with the capability to modify files and run commands within their assigned scopes (Capability Inventory: SKILL.md, Step 2 and Step 7).\n- [COMMAND_EXECUTION]: The orchestration process includes the execution of shell commands for verification and testing (e.g., npm test). These operations are strictly limited to isolated environments, such as dedicated git worktrees or fresh threads, ensuring that execution is contained and cannot affect the primary workspace unauthorized (Evidence: references/codex-threads.md, references/dynamic-workflows.md).\n- [REMOTE_CODE_EXECUTION]: The skill utilizes authorized platform features like Claude Code Workflows and Codex managed threads to execute sub-agent tasks. These environments provide native isolation, ensuring that each node in the graph runs in a fresh, ephemeral context that does not share session history or unauthorized state with the orchestrator.

graph-engineering