The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill relies on external configuration files (.ralph/plan.md, .ralph/items.json, .ralph/prompt.md) to guide the behavior of both the engine and sub-agent workers.
Ingestion points: Content is read from multiple files within the .ralph/ directory to define the objective, invariants, and worker contracts.
Boundary markers: The instructions lack specific guidance on using delimiters (such as XML tags or unique markers) when interpolating the content of these files into the worker's prompt, which could lead to instruction confusion if the files contain malicious prose.
Capability inventory: The skill possesses the ability to execute shell commands (Git plumbing), spawn new sub-agent processes, and run arbitrary 'judgment gates' (external scripts/helpers).
Sanitization: There is no mention of sanitizing or validating the Natural Language instructions found within the project files before they are processed by the agents.
[COMMAND_EXECUTION]: The engine is instructed to perform low-level Git plumbing operations and execute external 'judgment gates' to verify work quality.
Evidence: Use of 'Git plumbing' for hook-free commits and execution of 'current gates' outside the worker process to validate candidate trees.

ralph-loop