The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the astro and astro otto CLI tools. These commands are used for production diagnosis, Airflow fleet analysis, and environment management.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge to a sub-agent that possesses broad local capabilities. If the parent agent processes untrusted external data and passes it to Otto without proper sanitization, it could lead to the sub-agent executing malicious instructions.
Ingestion points: Data from the current project (DAGs, configuration) or user-supplied prompts passed as the argument to the astro otto command in SKILL.md.
Boundary markers: Examples show prompts wrapped in double quotes, which provides minimal protection against adversarial input.
Capability inventory: According to the documentation in SKILL.md, the sub-agent has access to bash, read, edit, write, and af (Airflow) tools.
Sanitization: The skill does not explicitly instruct the parent agent to sanitize inputs, but it recommends the use of --permission-mode plan to create a read-only sandbox for audits.
[EXTERNAL_DOWNLOADS]: The skill refers to updating the Astro CLI via brew and mentions that the astro otto component auto-updates daily from the vendor's infrastructure. These are expected behaviors for this service.

delegating-to-otto