The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted user-supplied explanations and git diff data, which are then passed to a sub-agent for evaluation against the SOLO rubric.
Ingestion points: The author's free-text explanation, git diff summaries, and optional artifact specifications (.cheese/specs/<slug>.md) are all ingested and passed into the prompt context for the judge sub-agent.
Boundary markers: The sub-agent instructions in references/judge-prompt.md include a specific "Untrusted input rule" that explicitly directs the agent to treat the input data as non-instructional and to ignore any commands or manipulation attempts within those blocks.
Capability inventory: The sub-agent is restricted to a "no-tool" or "read-only" configuration with fresh context, limiting the potential impact of a successful injection. The main skill manages local file writes to the .cheese/ directory using a local Python application.
Sanitization: The skill relies on sub-agent prompting and instruction-following to mitigate injection risks rather than performing programmatic sanitization or filtering of the user-provided text.
[COMMAND_EXECUTION]: The skill executes a local Python zip application (hard-cheese.pyz) to perform ranking, state management, and audit logging.
Evidence: Multiple steps in SKILL.md call python3 skills/hard-cheese/scripts/hard-cheese.pyz with user-provided arguments like the artifact <slug> to check freshness, rank code hunks, and append results to the audit trail.

hard-cheese