The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill documents and enables high-privilege repository operations, specifically allowing direct pushes to the main branch without a pull request. It also supports potentially destructive git operations, such as the use of --force and --no-verify flags. While the instructions note that these require explicit maintainer authorization, the inclusion of such capabilities in an automated harness significantly elevates the agent's privilege level within the target environment.
[COMMAND_EXECUTION]: The harness triggers multiple shell commands through npm scripts, including npm run validate, npm test, and npm run evals. This capability allows for the execution of arbitrary scripts defined within the repository's package.json file, which could be leveraged to run malicious code if the project configuration is altered.
[DYNAMIC_EXECUTION]: The orchestrator manages a complex workflow by dynamically spawning and coordinating multiple subagents (e.g., skill-author, eval-curator, release-manager) using the Agent tool. It generates task contracts and manages the flow of information between these independent AI instances to complete multi-stage development tasks.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes outputs from subagents and external validation tools.
Ingestion points: The orchestrator reads summaries produced by subagents in the _workspace/brooks-harness/ directory and logs from npm-based test suites.
Boundary markers: The pipeline uses defined roles and "task contracts" to scope agent behavior, but lacks explicit instruction-filtering or sanitization for the data passed between stages.
Capability inventory: High-privilege actions including repository file modification, arbitrary npm script execution, and git pushes to the main branch are available in SKILL.md.
Sanitization: The skill relies on a consistency-qa stage for verification, which creates a loop-back mechanism that could be influenced by malicious content embedded in the tools or subagent summaries it audits.

brooks-harness