The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the orchestrator to execute a local Python script (scripts/i2r.py) using the Bash tool for workflow initialization, assembly, and status checking. Commands such as python scripts/i2r.py init <idea|dir> --lang <zh|en> incorporate user-influenced variables (paths and language selection), which presents a potential command injection surface if the agent does not properly sanitize inputs before passing them to the shell.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest raw, potentially messy user ideas and product requests, which are processed through multiple stages of LLM analysis. This ingestion creates a vulnerability surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context through files in the raw/ directory and user-provided answers during the CLARIFY-LOOP recorded in raw/clarifications-*.md.
Boundary markers: The system uses strict schema validation (schemas/00-mode-routing.schema.json), a hard boundary prohibiting implementation details (no 'HOW' or 'WHEN'), and a 'Reader Test' where a fresh critic must interpret the out/ package without access to internal logs or raw inputs.
Capability inventory: The orchestrator has access to file system tools (Read, Write, Edit, Glob, Grep), shell execution (Bash), and sub-agent dispatch (Agent).
Sanitization: Malicious instructions are mitigated by a mandatory dual-review loop ('Reviewer A' and 'Reviewer B' / Codex), deterministic placeholder scans, and structural checks that fail the run if machine-contract commands or non-markdown files are detected in the output package.

idea-to-requirements-orchestrator