The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to read output from external monitoring sources (like reports/task_loops/<task_id>/live.md) and post the chat_line content directly into the user chat. Because this content is sourced from potentially untrusted logs, files, or remote command outputs, an attacker could place malicious instructions in these data sources to influence the agent's behavior or deceive the user.
Ingestion points: The agent reads data from reports/task_loops/<task_id>/live.md and the chat_line field generated by adapter scripts.
Boundary markers: No specific delimiters or "ignore instructions" warnings are mentioned for the content fetched from the monitored task.
Capability inventory: The agent has the capability to execute shell scripts (task_loop_start.sh, task_loop_stop.sh) and perform SSH operations.
Sanitization: There is no evidence of content sanitization or validation of the progress data before the agent processes and relays it.
[COMMAND_EXECUTION]: The skill architecture is built around creating and using configuration files (config.template.json) that contain a poll_command field. This field allows for the definition of arbitrary shell commands which are subsequently executed by a runner script (task_loop_poll.py) to check task progress. If the configuration is maliciously modified, it could lead to arbitrary command execution on the host.
[REMOTE_CODE_EXECUTION]: The skill includes a remote_fetch mode and a corresponding script template (fetch.template.sh) that uses SSH to execute commands on remote servers (e.g., ssh "${REMOTE_USER}@${REMOTE_HOST}" "cat '${PROGRESS_PATH}'"). This enables execution of commands on remote infrastructure, which is a significant capability that depends on the integrity of the remote environment and connection parameters.
[DYNAMIC_EXECUTION]: The skill involves the generation and execution of scripts based on templates, such as scripts/task_loop_adapters/<task_id>_adapter.py. Furthermore, the poll_adapter defined in the JSON configuration is a command string that is dynamically invoked by the task runner, representing a pattern where execution paths and logic are determined at runtime by configuration files.

task-loop-progress