The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill orchestrates a subagent workflow that directly interpolates untrusted user requests into the implementation subagent's prompt. This creates an attack surface where an adversary can craft a request that includes hidden instructions designed to bypass the subagent's task boundaries or the parent agent's safety protocols.
Ingestion points: The original user request is ingested via the $delegate command described in SKILL.md.
Boundary markers: The instructions in SKILL.md require the parent agent to "reproduce the original user request verbatim," which lacks robust delimiters or instructions for the subagent to disregard directives embedded within that specific user content block.
Capability inventory: Implementation subagents are granted capabilities to read repository files in full, perform detailed source code edits, and execute validation scripts.
Sanitization: No sanitization, escaping, or structural validation of the user's request is prescribed before it is forwarded to the implementer model.
[DYNAMIC_EXECUTION]: The skill coordinates the runtime creation of execution contexts for subagents. It dynamically constructs implementation contracts and prompts for a specific model configuration (gpt-5.6-luna with reasoning_effort: "max"), which constitutes a form of dynamic instruction execution where the subagent's behavior is guided by a prompt assembled at runtime from external inputs.

delegate