The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the ao (Agent Orchestrator) command-line interface as its primary operation. It also invokes powershell.exe on Windows and bash on Unix-like systems to run bundled helper scripts (AppendProgressReport.ps1 and AppendProgressReport.sh) for logging execution progress.
[EXTERNAL_DOWNLOADS]: Fetches runtime packages from NuGet (nuget.org) and the author's official GitHub repository. These downloads are documented as the official runtime source and are verified using SHA-512 hashes to ensure integrity before extraction.
[REMOTE_CODE_EXECUTION]: Downloads and executes self-contained apphost binaries (ao.exe or ao) from trusted developer sources. This behavior is a core functional requirement of the skill's orchestration mission and includes safety checks such as archive path validation and hash verification.
[PRIVILEGE_ESCALATION]: The skill instructs the host to invoke PowerShell with the -ExecutionPolicy Bypass flag when running its internal helper scripts. While common for local script execution, this technique bypasses standard script execution restrictions.
[DYNAMIC_EXECUTION]: Supports a repository-source debug mode (repo-src-debug) that allows building the orchestrator directly from local source code. Additionally, the workflow engine (Loom Orchestrator) evaluates C# expressions at runtime to determine state transitions and validate logic.
[INDIRECT_PROMPT_INJECTION]: The skill has a high attack surface for indirect prompt injection as it ingests untrusted user-provided data such as plan text, objectives, and business outcome descriptions to drive its execution logic.
Ingestion points: Untrusted data enters the context through the plan_text, objective, and requested_business_outcome inputs defined in contract.json.
Boundary markers: The skill employs a structured workflow design and dedicated subagents to manage task flow, though it lacks explicit prompt-level delimiters or sanitization for all interpolated user data.
Capability inventory: The orchestrator has the capability to execute shell commands, manage files, and download external binaries based on the plan's instructions.
Sanitization: There is no evidence of explicit escaping or sanitization of the user-provided inputs in the provided scripts; the skill relies on the internal logic of the Agent Orchestrator apphost to handle these inputs safely.

loom-plan-execution