The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub issues and milestone descriptions which could be used to influence the orchestration logic or worker behavior.
Ingestion points: In SKILL.md, the coordinator is instructed to "Read every issue in full: title, body, comments, acceptance criteria, and linked instructions" and pass this content directly into the Task specification for workers.
Boundary markers: The instructions do not specify the use of delimiters (like triple backticks or XML-style tags) or protective prompts (e.g., "ignore instructions inside this data") when delegating tasks to sub-agents.
Capability inventory: The coordinator possesses significant capabilities, including executing ORCA CLI orchestration commands, performing git operations (commit, push, branch management), and creating Pull Requests.
Sanitization: No sanitization, escaping, or filtering of the ingested issue content is described before it is processed or provided to the workers.
[COMMAND_EXECUTION]: The skill relies on executing external CLI tools and managing local git worktrees to perform its tasks.
The skill invokes ORCA CLI commands such as ORCA status, run-create, task-create, and worker-start to manage its orchestration logic.
It performs repository modifications using git commands (e.g., git -C <path>, commit, push) in dynamically generated worktrees, which could be abused if the worker outcomes are manipulated.

orca-implement