The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes Python scripts from a shared directory (e.g., task_queue.py, run_state.py, context_packet.py) to manage task scheduling, verify inputs, and track resource usage. These scripts are executed as subprocesses with parameters derived from the local environment and user approval.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task manifests, product requirement documents (PRDs), and repository files, which could contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Data enters the context from task manifests located in .ai-workflow/work/, queue.json, and user-provided PRDs.
Boundary markers: The skill employs 'context packets' and briefs to structure inputs, but it does not specify explicit 'ignore instructions' delimiters for all ingested data.
Capability inventory: The skill can execute shell commands (Python scripts) and perform git-related actions such as creating commits and opening pull requests via the open-pr tool.
Sanitization: The orchestration logic uses SHA-256 hash verification to ensure the integrity of task files and approval records, though it lacks semantic sanitization of the natural language content within those files.

implement-tasks