The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process user-generated notes and critic verdicts to steer its building attempts, which is a classic ingestion point for untrusted instructions.
Ingestion points: External feedback is received via the helix loop wait command (yielding note.added) and the /api/state endpoint.
Boundary markers: The instructions do not specify any delimiters or instructions for the agent to disregard malicious directives embedded within these text fields.
Capability inventory: The agent has access to Bash and PowerShell tools to execute the helix binary, write to the filesystem, and interact with local network services.
Sanitization: There is no evidence of sanitization or validation performed on the feedback strings before they are incorporated into the agent's task context.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage local processes and orchestrate sub-agents.
Evidence: The skill provides a command to terminate processes by extracting a PID from a configuration file using sed: kill "$(sed -n 's/.*"pid": *$[0-9]*$.*/\1/p' .../server.json)".
Evidence: The lead agent is responsible for constructing and issuing CLI commands to builder and critic sub-agents.
[DATA_EXPOSURE]: The skill performs requests to a local service to retrieve operational state.
Evidence: The skill uses curl to access http://127.0.0.1:$PORT/api/state, where the port is dynamically parsed from a local metadata file.

loop