The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external sources, including GitHub/GitLab issues, Jira tickets, Linear issues, and free-form implementation goals provided as prose. This content is interpolated into instructions for sub-agents during the 'Scout' phase in scripts/scout-fanout.mjs (e.g., ${t.ref} and ${t.hint}). Maliciously crafted ticket descriptions could attempt to influence the sub-agent's behavior or poison the structured analysis returned to the orchestrator.
Ingestion points: Issue/ticket descriptions fetched from trackers, user-provided goal strings in the command invocation.
Boundary markers: The skill uses a structured JSON schema (SCOUT_SCHEMA) to validate sub-agent output, reducing the impact of unstructured injections, though it does not fully prevent them.
Capability inventory: The sub-agents can perform file analysis; the orchestrator can write files, create worktrees, and perform PR operations (git, gh, glab).
Sanitization: No explicit sanitization of interpolated ticket data is mentioned in the prompt construction.
[COMMAND_EXECUTION]: The skill makes extensive use of system commands for repository management. It utilizes git worktree for environment isolation, and GitHub/GitLab CLI tools (gh, glab) for pull request lifecycle management. These commands are integral to the stated purpose of the skill and operate within the user's authenticated scope.
[PERSISTENCE]: The skill maintains execution state by writing a ledger file to the repository's .git directory (.git/blacksmith/run-<id>.json). This mechanism ensures that orchestration runs can be resumed after interruption and prevents duplicate work by tracking the state of each task (provisioned, running, pr-open, etc.).

blacksmith-orchestrate