The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external task definitions from project files, GitHub issues, and pull requests to parameterize the kickoff prompts for spawned worker sessions, creating a surface where untrusted data could influence agent behavior. • Ingestion points: Task files, GitHub issue content (via open_issue_session), and pull request descriptions (via open_pr_session) are read to generate worker instructions. • Boundary markers: The kickoff prompt template uses structural headers like 'What to do' and 'Constraints' to scope worker tasks, but lacks rigorous sanitization or explicit 'ignore' instructions to prevent the sub-agent from following commands embedded in the task data. • Capability inventory: The orchestrator possesses capabilities for session lifecycle management (create_session, delete_item), cross-session communication (send_session_message), and repository operations (git merge, create_pull_request). • Sanitization: The skill description does not outline any specific filtering, validation, or escaping logic for external task content before it is interpolated into worker prompts.

dispatch