The Agent Skills Directory

[PROMPT_INJECTION]: The skill ingests untrusted user instructions and external content, creating an attack surface for indirect prompt injection within the feature lifecycle.
Ingestion points: As described in methodology.md §2.1, the agent reads the user's framing and external web content, which is then recorded in project files.
Boundary markers: The methodology relies on human-readable headers and manual secret redaction rather than cryptographically sound or automated boundaries for untrusted data.
Capability inventory: The skill grants the agent control over the herdr session multiplexer, git operations, make tasks, and the execution of Node.js and Bash scripts.
Sanitization: The instructions explicitly require the agent to manually redact PII and credentials using [REDACTED] markers before committing data to the repository.
[COMMAND_EXECUTION]: The skill executes local scripts for configuration management and to verify the security of the shell environment.
Evidence: scripts/mo-posture.sh is a diagnostic tool that uses shell probes to detect if critical builtins (e.g., command, type) are shadowed by potentially malicious aliases. scripts/mo-models.mjs uses spawnSync to interact with git and AI provider CLIs for setting management.
[EXTERNAL_DOWNLOADS]: The mo-models.mjs utility attempts to dynamically load the @anthropic-ai/claude-agent-sdk package to fetch model capabilities.
Evidence: The script attempts to resolve the package from the local project path or the global npm root. This targets the official SDK from Anthropic.

mo-herdr