The Agent Skills Directory

[PROMPT_INJECTION]: The instructions contain directives to conceal specific internal operations from the user. For example, in the 'Background monitoring UX' section, it states: 'Suppress unchanged heartbeats and raw tool output' and 'Never relay raw commands or reasoning.' While intended for a cleaner user interface, these instructions limit the user's ability to audit the agent's background actions in real-time.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing untrusted data through a multi-step automated pipeline.
Ingestion points: Untrusted data enters the context via the goal parameter in the ouroboros_start_auto tool, the ~/.ouroboros/config.yaml file, and auto_answer_log entries retrieved via ouroboros_session_status.
Boundary markers: The instructions mention 'source-tagged auto answers' and a 'ledger' for structured tracking, but lack explicit 'ignore embedded instructions' warnings for the processing of user-provided goal prose.
Capability inventory: The skill has the capability to start background execution jobs, spawn independent child agents/sessions (using spawn_agent or Task systems), and write to the active auto workspace.
Sanitization: There are no instructions for sanitizing or validating the goal text or external configuration values before they are used to drive the automation pipeline.
[DYNAMIC_EXECUTION]: The skill is designed to generate an 'A-grade Seed' (a software artifact or plan) and then execute it. The 'Behavior' section explicitly describes a process of iterative repair followed by execution once a quality grade is reached, which constitutes dynamic generation and execution of code/logic.
[COMMAND_EXECUTION]: The skill orchestrates background jobs (referenced as the 'run → evaluate → ralph' chain) that involve executing commands and managing implementation workers.

auto