The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the conversation transcript to audit the decision log. This creates a surface for indirect prompt injection where instructions hidden in earlier turns or external data could influence the audit process or the behavior of review subagents.
Ingestion points: The history recipe is used to read the current session's transcript in both SKILL.md (Audit section) and during the cross-model review phase.
Boundary markers: The instructions explicitly warn the agent: "Don't read other projects' history. That reads unrelated private chats." This provides a logical boundary to prevent cross-project data exposure.
Capability inventory: The agent can append to local files using scripts/log.sh and spawn subagents with access: full via the arena platform feature.
Sanitization: The scripts/log.sh utility contains a clean() function that actively sanitizes inputs by stripping tabs, newlines, and carriage returns (preventing TSV structure corruption) and prefixing spreadsheet formula characters (=, +, -, @) with a single quote to prevent CSV/TSV injection attacks.
[COMMAND_EXECUTION]: The skill utilizes a local bash script scripts/log.sh to handle logging. This script was analyzed and found to be implemented securely, using set -euo pipefail for error handling and avoiding dangerous primitives like eval or unsanitized input to command shells.

show-me-your-work