The Agent Skills Directory

[COMMAND_EXECUTION]: The measurement system in scripts/measurements.ts executes arbitrary shell commands using bash -c. These commands are authored by the AI Planner agent and stored in plan.json. While the execution environment is partially restricted via an environment variable allowlist and a temporary home directory, the commands themselves are not validated and could be used for malicious purposes if the agent is compromised or via prompt injection.
[PROMPT_INJECTION_INDIRECT]: The skill is highly vulnerable to indirect prompt injection (Category 8).
Ingestion points: The script reads handoff files from workers (untrusted data) via scripts/core/agent-manager.ts and scripts/core/prompts.ts.
Boundary markers: Absent. Instructions in references/handoffs.md specifically state "Don't enrich or sanitize; the planner needs the worker's words unfiltered."
Capability inventory: The system has significant capabilities including spawning new cloud agents, executing shell commands (via git and measurements), and posting to Slack.
Sanitization: Handoff bodies are interpolated verbatim into downstream agent prompts, allowing a malicious worker to influence the Planner's logic or downstream tasks.
[DATA_EXPOSURE]: The skill manages sensitive credentials including CURSOR_API_KEY and SLACK_BOT_TOKEN. Although scripts/core/redact-body.ts implements redaction logic for Slack comments, these secrets are inherently present in the environment for the orchestration scripts to function.

orchestrate