The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external and potentially untrusted sources such as issue descriptions, PR reviews, and CI logs.\n
Ingestion points: Data is read from repository files (orca.yaml, tigerkit.config.json), Git command outputs, and external issue trackers (SKILL.md, references/configuration.md).\n
Boundary markers: The skill explicitly defines a "Retrieved Evidence Boundary" section which instructs the agent to treat natural language from external sources strictly as data, ensuring it cannot override the skill's protocols or authority (SKILL.md).\n
Capability inventory: The skill has the capability to execute git and orca CLI commands and trigger repository-tracked scripts (SKILL.md, references/configuration.md).\n
Sanitization: There are explicit instructions to ignore instruction-like text found within processed data and to stop execution if the context identity is unverifiable (SKILL.md).\n- [DYNAMIC_EXECUTION]: The skill allows for the execution of automation hooks during the worktree lifecycle.\n
Evidence: The configuration policy supports onCreateScript and onCloseScript fields in JSON configuration files (references/configuration.md).\n
Mitigation: Execution is strictly limited to repository-relative tracked script paths. The skill prohibits the use of absolute paths, parent directory traversal (..), symlinks, or untracked code, and requires the agent to verify user authorization before every execution.\n- [COMMAND_EXECUTION]: The skill relies on system-level Git and Orca commands for its primary operations.\n
Evidence: Instructions detail the use of git worktree add, git worktree remove, and various orca worktree commands (SKILL.md, references/worktree-operations.md). Safety checks are mandated to verify worktree ownership and branch identity before destructive operations.

tk-wt