The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an autonomous orchestrator that delegates tasks to multiple subagents and processes their results to decide on subsequent actions and plan revisions. This architecture creates a vulnerability where instructions embedded in the data processed or generated by a subagent could influence the coordinator's execution logic.
Ingestion points: The coordinator ingests worker findings, status reports, and audit files (e.g., audit_output_file) generated by sub-processes in SKILL.md and referenced harness guides.
Boundary markers: The instructions do not define explicit delimiters or sanitization protocols for handling output from subagents before it is interpolated into the coordinator's context.
Capability inventory: The skill possesses high-privilege capabilities including the ability to spawn up to 10 concurrent subagents, perform filesystem operations, and execute shell commands.
[COMMAND_EXECUTION]: The harness guides (references/claude-code.md and references/codex.md) provide specific shell commands to invoke external AI CLI tools like codex and claude for plan auditing. While the skill includes instructions to use sandboxing flags (e.g., --sandbox read-only, --permission-mode plan), the autonomous execution of CLI tools with redirected input from local files represents a significant capability that must be monitored.

full-send