The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system commands via Python's subprocess module to perform project analysis and manage the security pipeline state. These include calls to git for version control checks, jar and javap for Java bytecode disassembly, and the opentaint CLI for health checks and ruleset discovery. The instructions also describe the use of docker, docker compose, and kill for managing test environments during the Proof of Concept (PoC) stage.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests and processes data from external sources, including SARIF reports, project manifests (project.yaml), and tracking files generated by leaf subagents. This creates a surface where malformed input from processed projects or subagent summaries could influence the orchestrator's decision-making logic.
Ingestion points: Data enters the agent's context from .opentaint/results/report.sarif, project.yaml, and various YAML tracking files in the .opentaint/tracking/ directory.
Boundary markers: The instructions do not define specific delimiters for separating processed data from agent instructions, though the skill relies on specialized Python scripts to parse this data into structured summaries.
Capability inventory: The skill possesses capabilities to execute shell commands for project analysis (git, jar, javap), container management (docker), and pipeline operations (opentaint CLI).
Sanitization: The scripts use yaml.safe_load for parsing YAML data, which mitigates standard deserialization attacks.

orchestrate-stage