The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's core functionality relies on executing shell commands provided by the user or derived from goals (e.g., Verify, Guard, and Target commands). While it implements a safety screen (scripts/orchestrate.sh screen-cmd) to block dangerous patterns like rm -rf or curl|bash, the ability to execute arbitrary shell commands poses a risk if the safety logic is bypassed.
[INDIRECT_PROMPT_INJECTION]: The skill ingests large amounts of untrusted data, including codebase files (in learn.md and debug.md), git logs, test outputs (in regression.md), and web search results (in improve.md). This data is used to inform code changes and documentation generation without explicit boundary markers or robust sanitization against embedded instructions.
Ingestion points: Reads files via Scope: globs, git log, git diff, and WebSearch results.
Boundary markers: The instructions lack explicit delimiters when interpolating external content into prompts for analysis.
Capability inventory: Includes file system writes, git commit/revert, and shell command execution.
Sanitization: Employs a regex-based safety screen for commands and a post-generation secret scanner for documentation.
[DYNAMIC_EXECUTION]: The orchestrator dynamically derives shell commands from natural-language goals (plan.md) and uses node -e in helper scripts (scripts/orchestrate.sh) to parse and validate persisted state files at runtime.
[SAFE]: The skill implements several security best practices, including a multi-layer secret detection system in learn.md and a strict anchored database allowlist in regression.md that restricts data migrations to local or explicitly tagged test databases.

autoresearch