The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to invoke external CLI tools like gemini and codex for cross-model verification. The instructions include significant safety constraints, such as mandatory user confirmation for every invocation, verification of the tool's existence in the system path, and testing the binary before full execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external code or data artifacts, creating a potential surface for indirect prompt injection. The instructions acknowledge this risk and prescribe robust mitigations.
Ingestion points: External code snippets or proposals are loaded into the agent's context during the review cycle in SKILL.md.
Boundary markers: The process mandates stripping reasoning and isolating the artifact from the orchestrator's claims to prevent bias and accidental command triggers. It uses specific adversarial prompt templates to focus the model.
Capability inventory: The skill facilitates shell execution of external review tools and temporary file writing to /tmp.
Sanitization: The instructions explicitly mandate the use of read-only sandboxes for external CLI execution and require piping input via stdin (or heredocs) instead of shell interpolation to prevent the artifact's content from being interpreted as shell commands.
[DYNAMIC_EXECUTION]: The instructions involve the dynamic creation of prompt files in the /tmp directory, which are then passed to external processes. This is performed using a transparent, safety-first approach to ensure that the content of the artifact remains inert data during execution.

doubt-driven-development