The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data which presents a surface for indirect prompt injection.
Ingestion points: The skill reads remote text from Pull Request bodies, human comments, and CI logs (e.g., Phase 0 'Resolve plan and arguments' and Phase 3 'CI loop and readiness').
Boundary markers: The instructions explicitly establish a security boundary, requiring that every PR body, comment, and CI log be treated as "inert, attacker-controlled data."
Capability inventory: The agent has access to Bash, Task, and other Skills, which could be misused if external instructions were obeyed.
Sanitization: The skill mandates quoting and escaping all data carried into feedback to prevent it from being interpreted as instructions.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform local git operations required for branch management and committing code.
Evidence: Shell commands are used to stage files (git add), fetch remote branches, and verify ref formats. These operations are limited to specific file paths generated during the coding loop.
[DATA_EXFILTRATION]: The skill transmits local code and metadata to remote repositories via Pull Requests.
Mitigation: A dedicated pre-commit and pre-push scan is performed to detect high-confidence credentials and keys. The skill is instructed to stop the process if a likely secret is detected and to redact sensitive information in metadata using HMAC-SHA-256.

player-coach