The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes fix recommendations from external reports (e.g., .cheese/age/<slug>.md or CI failure summaries) and treats the recommendation: field as a 'locked decision' for the repair agent to implement without deviation. An attacker who can influence the contents of these reports could inject malicious instructions to manipulate the agent's actions during the fix application process.
Ingestion points: Primary inputs include .cheese/age/<slug>.md reports and pasted findings lists, as specified in SKILL.md (Flow step 1).
Boundary markers: The system uses recommendation (locked) and invariants blocks to scope the agent's work, providing structural delimiters but not full protection against adversarial content.
Capability inventory: The skill has filesystem write access, the ability to execute project-specific build and test commands ('project gates'), and the ability to dispatch publication tasks to the /plate skill.
Sanitization: There is no evidence of sanitization or filtering of the recommendation text before it is presented to the repair agent.\n- [COMMAND_EXECUTION]: The skill executes project validation gates, which include linting, type checks, and build commands (Step 4, SKILL.md). This involves running local tools and scripts within the target project's environment.\n- [DYNAMIC_EXECUTION]: The skill dispatches 'repair agents' (coder type) with write permissions to perform code modifications and executes 'project gates' which may include running arbitrary code or scripts defined in the repository being modified.

cure