The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates a multi-stage agent pipeline where outputs from research agents (Explore, Librarian) are directly interpolated into the prompt context for implementation agents (Develop, Frontend). This creates a vulnerability surface for indirect prompt injection.
Ingestion points: Data enters via the 'Explore output' and 'Librarian output' fields within the 'Context Pack' (referenced in SKILL.md and agent instruction files).
Boundary markers: The skill uses ## headers to delimit sections, but lacks explicit guardrails or instructions for sub-agents to disregard malicious commands that might be embedded in the codebase or external documentation being processed.
Capability inventory: The develop.md and frontend-ui-ux-engineer.md agents possess file-write and edit capabilities to implement code changes.
Sanitization: No evidence of sanitization or filtering of external content is found before it is passed between agents.
[COMMAND_EXECUTION]: The orchestrator (Sisyphus) uses a CLI tool codeagent-wrapper to invoke sub-agents. The command construction uses quoted heredocs (<<'EOF'), which is a security best practice to prevent shell interpolation of the agent input.
[EXTERNAL_DOWNLOADS]: The README.md instructs users to run python install.py --module omo for installation. This script is not provided in the skill files, representing a reference to external execution not audited here.
[METADATA_POISONING]: There is a minor metadata discrepancy between the author name in .claude-plugin/plugin.json ('cexll') and the platform-provided author context ('stellarlinkco'). Additionally, the README contains configuration examples referencing non-existent, future-dated model versions (e.g., gpt-5.2, claude-opus-4-5), which could lead to unexpected agent behavior or runtime errors.

omo