The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core logic (the Project Manager loop) relies on reading and interpreting YAML and Markdown files from the local workspace (such as state.yaml, goal.md, and files in notes/). These files, which are processed during autonomous execution, are used to generate instructions and prompts for sub-agents (Scout, Worker, and Judge).
Ingestion points: The scripts/render-task-prompt.mjs script reads the state.yaml file and interpolates fields like objective, inputs, and constraints into prompts for other agents.
Boundary markers: The prompts are structured but lack strict sanitization or explicit boundary markers to prevent the LLM from following instructions embedded within the task data.
Capability inventory: The skill possesses the ability to execute shell commands via several helper scripts and sub-agents with write access to the workspace.
[COMMAND_EXECUTION]: The task delegation script (scripts/dispatch-task.mjs) is vulnerable to command injection on Windows systems. The script uses spawnSync with the shell: true option to invoke CLI tools (codex or claude) using a prompt string that includes unvalidated content from the task board.
Evidence: In scripts/dispatch-task.mjs, the runHarness function uses shell: process.platform === 'win32'. An attacker-controlled or injected task objective in state.yaml could include shell metacharacters (e.g., & or |) to execute arbitrary commands when the PM agent dispatches a task.
[SAFE]: The skill includes a local web server (surfaces/local-goal-board/scripts/local-goal-board.mjs) for viewing the project board. The server implementation includes standard security controls for local tools, such as Host header validation, Origin checking to prevent CSRF, and path traversal checks for static file serving.
[SAFE]: The skill provides an update checker (scripts/check-update.mjs) that retrieves version data from the official NPM registry. This follows standard practices for software maintenance and does not pose a security risk.

goal-prep