The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes output from multiple parallel subagent attempts, creating an exposure to indirect prompt injection.
Ingestion points: Phase D ('Read every candidate end to end') and Phase E ('Walk each losing candidate once more') read rationales and artifacts from directory paths such as /tmp/arena-<slug>/candidate-<n>/.
Boundary markers: The instructions lack explicit boundary markers or directives to isolate or sanitize potentially malicious instructions embedded in subagent outputs.
Capability inventory: The agent has the capability to spawn subagents, read and write files, and execute local scripts.
Sanitization: A verification phase (Phase F) exists, but it focuses on functional correctness rather than security sanitization.
[DYNAMIC_EXECUTION]: The skill dynamically constructs tool identifier strings for reasoning effort parameters.
Evidence: Reasoning levels (e.g., 'low', 'medium', 'xhigh') are appended to base strings such as 'engineering:patina-agent-' to determine the subagent_type at runtime.
[COMMAND_EXECUTION]: The skill references the execution of a local utility script to maintain system configuration.
Evidence: The Models section notes that users may need to rerun tools/generate.mjs to synchronize role defaults from a JSON configuration file.

arena