The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill coordinates complex workflows by ingesting and processing data from multiple subagents and user-supplied implementation plans. This structure creates an inherent surface for indirect prompt injection, where malicious instructions embedded in a subagent's output or a project file could attempt to influence the parent agent's orchestration logic.
Ingestion points: Workflow plans, subagent task results, and external executor reports.
Boundary markers: The skill employs a strict "Node Prompt Contract" using specific delimiters (TASK, DELIVERABLE, SCOPE, VERIFY, STOP WHEN) to isolate instructions for subagents.
Capability inventory: The agent can execute local shell commands via the omh tool, manage git worktrees, delegate tasks to subagents, and write to the local file system.
Sanitization: Implements a mandatory omh handoff-risk-scan before execution and applies a strict denylist for verification commands (blocking shells, network utilities, and privilege escalation tools).
[COMMAND_EXECUTION]: The skill facilitates the execution of user-defined or project-specific verification commands, such as test suites and build scripts, as part of its completion validation logic.
Evidence: The references/team-lane.md and references/tdd-red-green.md files define procedures for running, capturing, and reconciling the output of local commands like pytest and npm test.
Mitigation: The skill requires explicit user authorization before initiating execution, uses dedicated worktrees for task isolation, and includes instructions to avoid running hazardous patterns like pipeline-to-shell or administrative commands.

ulw-work