The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines an autonomous orchestration loop that processes untrusted external data, creating a surface for indirect prompt injection. Ingestion points: The orchestrator ingests the user-provided task scope, the current state of a local repository (via the critique subagent), and structured critique reports (containing 'Needs Improving' and 'Next Steps' fields). Boundary markers: The instructions do not specify any boundary markers (e.g., delimiters or XML tags) or 'ignore embedded instructions' warnings when passing critique reports or repository context between subagents. Capability inventory: The implementation subagent is granted the capability to perform 'wholehog' passes against a 'real repo,' which typically involves extensive file system modifications and potentially code execution via the agent's available toolset. Sanitization: There is no evidence of sanitization, validation, or escaping of the content returned by the critique subagent before it is relayed as a work list to the implementation subagent.

wholehog-loop