The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing the comet CLI with various arguments. Instructions in SKILL.md (Step 0) and reference/scripts.md direct the agent to pass user requests and other variables directly into shell commands (e.g., comet task <project-root> --task "<original user request>"). This pattern creates a command injection risk if the user input contains shell metacharacters or unmatched quotes that escape the command's intended scope.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from various external sources and interpolates this content into prompts for the main agent and sub-agents. While the skill includes some management of this context, the ingestion of untrusted data into prompts is a known attack surface.
Ingestion points: comet CLI JSON outputs, .comet.yaml state files, tasks.md, and implementation plans containing user-defined tasks.
Boundary markers: The skill mentions using a Context Manifest for summaries and application reasons, and uses --expand-context for detailed data.
Capability inventory: The agent has the ability to execute shell commands, manage git repositories, and load other specialized skills.
Sanitization: The instructions mention injecting only returned text and using summaries, but lack explicit escaping or validation rules for content interpolated into shell commands or sub-agent prompts.
[DYNAMIC_EXECUTION]: The skill uses a coordinator model to dispatch background agents with specialized roles, loading other skills like subagent-driven-development and test-driven-development at runtime. This dynamic loading and execution of specialized agent logic, while central to the workflow, increases the complexity of the execution environment.

comet-classic