The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts for workflow management, specifically workflow.py, agent-hook.py, agent-preflight.py, and agent-finish-check.py. These commands utilize environment variables or placeholders like MORU_ROOT to locate scripts within the trusted rules repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user requests and external documentation. It mitigates potential injection attacks through a mandatory 'intent envelope' system that binds request fingerprints to session IDs and requires explicit 'approval records' for high-risk operations like repository writes.
Ingestion points: User requests provided via the --request flag and repo-local source documents (PRDs, specs, etc.) read during the source docs gate.
Boundary markers: The system uses structured intent envelopes and approval records to separate request intent from execution authority.
Capability inventory: The agent can execute local Python scripts, perform file system reads/writes in .moru/ directories, and interact with Git via wrappers.
Sanitization: Actions are gated by request classification and mandatory evidence verification performed by agent-finish-check.py.
[DATA_EXFILTRATION]: The skill records execution evidence and run states in local directories (.moru/ and ~/.moru/). While it handles sensitive context like credentials, it explicitly instructs agents that these items are for inspection only and do not authorize changes or external transmission.

scripted-agent-workflow