The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub pull request bodies and issue comments to drive its orchestration logic, such as identifying linked issues and verifying review artifacts. There are no explicit boundary markers or sanitization steps mentioned for this external content, creating a surface where a malicious user with access to the repository could influence the orchestrator's behavior.
[COMMAND_EXECUTION]: The skill performs high-impact operations using the gh CLI and git, including merging pull requests (gh pr merge) and managing git worktrees, based on state gathered from external sources. The instructions explicitly direct the agent to skip user confirmation for these actions, reducing human oversight.
[DYNAMIC_EXECUTION]: In reference/failure-recovery.md, the skill dynamically generates prompts for research workers and executes them via codex exec. This execution incorporates unverified attempt history and issue comments, which could lead to unintended agent actions if the source data is compromised.
[PERSISTENCE]: The skill uses MCP Memory (mcp__memory__create_entities) to maintain an ActiveOrchestration marker that survives context compactions and session restarts. This allows the orchestration loop to persist and automatically resume without new user intervention, which could be exploited to maintain long-term autonomous access.

autonomous-orchestration