The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data, including git diffs, specification excerpts, and user-provided explanations, which are passed to a judging sub-agent for evaluation. This represents a potential surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through git diff summaries, local specification files, and free-text user explanations collected during the gate process (described in SKILL.md steps 3, 4, and 5).
Boundary markers: The skill incorporates robust defensive instructions in references/judge-prompt.md. The 'Untrusted input rule' explicitly directs the sub-agent to treat all external content as data rather than instructions and to ignore any attempts to override the grading rubric.
Capability inventory: The sub-agent is strictly limited to providing a JSON-formatted grade and feedback. It is prohibited from calling tools or writing to the repository. The parent skill uses local, static scripts for processing.
Sanitization: The skill relies on clear LLM-based boundary instructions and structured JSON output to mitigate injection risks.
[COMMAND_EXECUTION]: The skill executes a local Python utility (skills/hard-cheese/scripts/hard-cheese.pyz) to perform freshness checks, rank diff hunks, and append attempts to the audit log. These commands use static, local paths bundled with the skill package.
[DYNAMIC_EXECUTION]: The skill dispatches a 'fresh-context' judging sub-agent to evaluate responses. This implementation follows security best practices by isolating the evaluator from the author's code-writing context to prevent bias and ensure the grading logic remains untampered.

hard-cheese