The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically ToVo issues and project context, which is then passed as instructions to sub-agent worker threads. This creates a surface where malicious instructions embedded in an issue description could influence the behavior of the sub-agents.
Ingestion points: Data enters the context via the tovo skill connection to issue trackers and general project file reads (referenced in the 'Plan the run' and 'Run each unit' sections of SKILL.md).
Boundary markers: The orchestration instructions use markdown code blocks to encapsulate the worker's brief, but they lack explicit negative constraints or instructions for the worker to ignore commands found within the issue data.
Capability inventory: The skill possesses the capability to launch new agent threads (t3_thread_launch), communicate with them (t3_thread_send), and modify external issue tracker statuses (issue_set_status).
Sanitization: No sanitization, escaping, or validation is performed on the issue context before it is passed to the worker threads.
[COMMAND_EXECUTION]: The orchestrator directs worker threads to 'run the project's checks.' In a software development context, this typically involves executing arbitrary scripts, binaries, or test runners (e.g., npm test, pytest) located within the repository. This is an expected behavior for a developer tool but represents a risk if the agent is used on an untrusted repository containing malicious build/test scripts.

orchestrate