The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's bootstrap process runs bun install to fetch Node.js dependencies. However, the provided package.json and bun.lock specify non-existent or anomalous version numbers for standard packages, such as typescript@7.0.2 and commander@14.0.0. These versions are not available on the official NPM registry, posing a risk of unverifiable code execution or dependency confusion.
[COMMAND_EXECUTION]: The orchestration tool executes external commands including git, gh (GitHub CLI), and gt (Graphite CLI) to manage repository state, pull requests, and stacked branches. While these are necessary for the skill's intended functionality, they involve significant local repository mutation capabilities.
[DATA_EXFILTRATION]: The worktree-audit.sh script accesses sensitive local data stored in the Cursor IDE's project directory (~/.cursor/projects/), specifically searching through agent transcriptions to correlate worktrees with chat history. This represents local data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes data that could be influenced by external actors or child agents:
Ingestion points: External completion reports in the inbox/ directory, unit definitions in units.tsv, and verification results in ledger.tsv (found in scripts/orch/store.ts).
Boundary markers: The skill instructions define a structured template for briefs in SKILL.md to help delineate agent instructions.
Capability inventory: The CLI tool can read/write files and execute repository management commands across the workspace.
Sanitization: The implementation includes a cleanCell function in scripts/orch/store.ts to escape potential spreadsheet formula injection characters (=, +, -, @) in TSV data storage.

orchestrate