The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies extensively on the 'rig' CLI to manage agent teams and repository tasks. It instructs the agent to execute commands such as rig up, rig down, rig grow, rig queue create, and rig workflow compile to manage system resources and coordination.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external repository files, which creates a surface for indirect prompt injection attacks.
Ingestion points: The agent is instructed to read content from files such as SPEC.md, TASK.md, mission.yaml, and other repository-specific documentation (found in SKILL.md and references/worked-example.md).
Boundary markers: The instructions suggest using YAML frontmatter and Markdown headings to structure inputs, though these are not robust security boundaries against adversarial content.
Capability inventory: The framework has high capabilities, including the ability to launch new agent sessions (rig up), add team capacity (rig grow), and transfer tasks between agents via a queue.
Sanitization: The skill includes several built-in safety mechanisms: it requires a dedicated 'reviewer' agent to independently check all implementation candidates, and it explicitly instructs the agent to obtain user confirmation before executing lifecycle commands or modifying project settings.
[PRIVILEGE_ESCALATION]: The skill includes a procedure for 'Applying a permission policy' which allows the user to grant the agent persistent command allowances. While this increases the agent's privilege, the instructions emphasize that this must be an explicit user opt-in ('Yes / No — keep the team default') and that lifecycle commands should still trigger prompts by default.

openrig-software-factory