The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates as a high-level bash driver (templates/driver.template.sh) that orchestrates a series of headless agent sessions. These sessions are granted the ability to execute shell commands and interact with Docker containers to perform model training and evaluation tasks. While powerful, this behavior is the primary intended purpose of the skill and is constrained by specialized adapters.
[INDIRECT_PROMPT_INJECTION]: The driver script snapshots content from commands.log, progress.log, and state.json into the system prompt of subsequent agent sessions to maintain state across fresh sessions. This creates a surface where malicious data written to these files by a compromised or misbehaving stage could influence the behavior of later stages.
Ingestion points: templates/driver.template.sh reads logs and state artifacts from the run directory ($RD) and interpolates them into the PROMPT variable sent to the agent.
Boundary markers: The prompt uses clear delimiters like ===== CARD ===== and ===== STATE ===== to separate stage instructions from history, though these are not cryptographically signed.
Capability inventory: The agent has access to bash, docker, and file system manipulation tools (read, edit, write).
Sanitization: The skill provides a guard.ts extension that sanitizes command execution and blocks access to sensitive files, but the log data injected into the prompt is only truncated, not sanitized for instruction sequences.

tao-token-efficient-execution