The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes action plans derived from 'recommendations' produced by other skills. If those parent skills ingest data from untrusted external sources (e.g., website content, PR descriptions), malicious instructions could be embedded in the proposed actions to execute unintended outbound operations.
Ingestion points: The skill takes input from recommendations, PRDs, and checklists provided in the agent's context or shared environment (SKILL.md).
Boundary markers: Action plans are structured as JSON, and a dedicated helper script (scripts/action_preview.py) is used to render these plans for human review and explicit approval before execution.
Capability inventory: The skill can perform outbound and destructive operations (e.g., posting to Slack, creating GitHub issues, deleting records) via connected Model Context Protocols (MCPs). It also executes local Python scripts to manage the action lifecycle.
Sanitization: Risk classification is performed via simple keyword matching on operation names in scripts/action_preview.py. There is no evidence of structural sanitization or escaping of the operation arguments (args) before they are passed to target APIs.
[COMMAND_EXECUTION]: The skill uses shell commands to execute local Python scripts for plan validation and logging.
Evidence: SKILL.md instructs the agent to run python3 scripts/action_preview.py for risk gating and python3 ../professional-brain/scripts/brain_write.py for recording actions. These calls depend on the availability of external scripts and a specific directory structure.

action-runner