The Agent Skills Directory

[SAFE]: The skill is composed entirely of Markdown files providing procedural guidance. There are no executable scripts, configuration files that automate system changes, or hidden binaries.
[PROMPT_INJECTION]: The skill contains a 'behavior fixtures' file (B7) which explicitly lists a prompt injection attempt as a test case to ensure the agent ignores malicious instructions embedded in source data. This is a defensive testing mechanism.
[INDIRECT_PROMPT_INJECTION]: The skill addresses this attack surface by instructing the agent to treat external source text as evidence only, never as a source of new authority. It provides a mandatory evidence chain for evaluation.
Ingestion points: Data entering the context via 'source handles' or 'worker assignments' (SKILL.md, router-integration.md).
Boundary markers: The protocol requires an 'Assignment contract' that defines permitted effects and output paths.
Capability inventory: The skill discusses file reading, writing (generator), and optional shell execution (router reference).
Sanitization: It mandates independent acceptance checks and source/diff review before integration.
[COMMAND_EXECUTION]: The guidelines specifically warn against executing unvalidated classifier output as arbitrary shell text, demonstrating a clear security-first design for routing logic.
[DATA_EXFILTRATION]: The protocol emphasizes 'restricted transfer,' advising that workers should only receive minimal task context and that local source code should not be sent remotely without explicit authorization.

bounded-delegation