The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and delegating tasks based on codebase artifacts, git diffs, and phase drafts. This creates a vulnerability surface where malicious code or instructions embedded in the analyzed repository could attempt to influence the subagents' logic or outcomes.
Ingestion points: The agent processes files under /.recursive/run/, /.recursive/memory/, and arbitrary code files within the worktree during audit and implementation phases.
Boundary markers: The skill defines a structured 'Delegated Audit Contract' (e.g., specific phase names, artifact paths, and verdict requirements). While this structure helps organize data, it does not explicitly sanitize or delimit untrusted content to prevent injection attacks.
Capability inventory: The system allows for file modifications via the implementer agent and execution of shell commands through git and the recursive-router-invoke tool.
Sanitization: There is no evidence of explicit sanitization or escaping of external content before interpolation into subagent prompts.
[COMMAND_EXECUTION]: The skill instructions facilitate the execution of external CLI tools through a configured routing framework.
Evidence: SKILL.md instructs the agent to use recursive-router-invoke for 'external-cli' resolutions when dispatching tasks to routed tools or external models on the local device. This gives the agent the capability to trigger and interact with external processes based on its configuration.

recursive-subagent