The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes task lists from harness-tasks.json, which contains fields like validation.command and on_failure.cleanup that are directly executed as shell commands. This creates a surface for indirect injection where a malicious repository could trick the agent into executing arbitrary code.\n
Ingestion points: The harness-tasks.json file is read by multiple hooks, including hooks/harness-stop.py, hooks/harness-claim.py, and hooks/harness-sessionstart.py.\n
Boundary markers: There are no explicit delimiters or warnings to the agent to treat the contents of the task file as untrusted data.\n
Capability inventory: The framework leverages subprocess execution for validation commands, environment setup, and git operations (reset, clean).\n
Sanitization: The skill does not perform any sanitization or validation of the command strings before they are presented for execution.\n- [COMMAND_EXECUTION]: The skill is designed to automatically execute harness-init.sh from the project root at the start of every session. This allows for arbitrary shell script execution based on local project files without user confirmation.\n- [PROMPT_INJECTION]: The skill utilizes Codex platform hooks (Stop, TeammateIdle, SubagentStop) to override the agent's natural behavior. Specifically, hooks/harness-stop.py and hooks/reflect-on-stop.py use the block decision to override the agent's attempt to terminate a session. These hooks inject instructions that the agent must prioritize over its previous state to ensure the autonomous loop continues.\n- [DYNAMIC_EXECUTION]: The core logic of the framework involves the dynamic assembly and execution of shell commands based on task metadata. The agent is instructed via SKILL.md and hook feedback to execute these commands using timeout wrappers to validate work progress.

harness