The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the orca, git, and gh (GitHub CLI) tools using child_process.execFileSync. Arguments for these commands, such as program IDs, are sanitized via slugification to prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill uses the official GitHub CLI to fetch metadata for issues and pull requests associated with orchestrated programs. No arbitrary script downloads or execution patterns were detected.
[DATA_EXFILTRATION]: Accesses local git configuration, relay manifest files, and GitHub status information to reconcile the state of managed programs. This data is used internally for coordination and coordination "receipts" are stored locally in the ~/.relay/programs/ directory.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted program data and generates instructions for other agents.
Ingestion points: Scripts including scripts/plan.js, scripts/run.js, and scripts/status.js read program contract data from local JSON files via the --program-file parameter.
Boundary markers: While the input JSON is validated against a schema, the skill does not wrap the resulting data in explicit delimiters or include specific "ignore embedded instructions" warnings when formatting task data.
Capability inventory: The skill has significant capabilities, including the ability to execute shell commands (orca, git, gh) through multiple scripts based on program state.
Sanitization: The skill implements a boundedExcerpt helper in scripts/lib/bounded-excerpt.js that truncates all external subprocess output to 256 characters before inclusion in diagnostics or reports.

relay-orca