The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its high-autonomy orchestrator design. It processes external, potentially untrusted data to determine its next actions.
Ingestion points: The agent is instructed to read various task files (audit.md, task-state.md, milestones.tsv) and external QEMU-related artifacts (source code, register contracts, guest logs, and firmware facts).
Boundary markers: Absent. The instructions do not provide explicit delimiters or warnings to ignore instructions that might be embedded in the analyzed QEMU artifacts or logs.
Capability inventory: The skill executes shell scripts (scripts/loop-state.sh) and is designed to invoke other domain-specific skills that likely possess file system and shell execution capabilities.
Sanitization: Limited sanitization is performed; for example, loop-state.sh replaces tabs with spaces in milestone and acceptance criteria text to preserve TSV formatting.
[COMMAND_EXECUTION]: The orchestrator relies on a provided bash script, scripts/loop-state.sh, to manage task state, record verdicts, and decide when to continue the goal loop. It also facilitates the routing and execution of other CLI-heavy domain skills.
[PROMPT_INJECTION]: The skill contains instructions that promote high autonomy and the suppression of user oversight. It explicitly tells the agent: "Do not ask the user to 'continue' when the answer is already CONTINUE" and "immediately plan and start the next round—do not pause to ask the user whether to continue." This directive overrides standard human-in-the-loop safety checkpoints.

qemu-modeler