The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize results from multiple agent runs (stored in .ai/ and .coord/ directories). This creates a vulnerability surface where a compromised or malicious upstream agent could inject instructions into its output files that might influence the reconciler's summary or trigger unintended logic.\n
Ingestion points: Reads from .coord/plan.yml, .ai/*.result.json, .ai/*.md summaries, and .ai/*.txt logs, as well as conversation history for Claude-based tasks.\n
Boundary markers: Uses structured JSON for result metadata, but analysis of markdown summaries and log tails involves processing free-form text without explicit delimiter-based safety constraints mentioned in the instructions.\n
Capability inventory: The skill is scoped to reading files and generating a reconciliation report in the .coord/ directory. It does not possess broad write permissions or network access.\n
Sanitization: There is no mention of sanitizing or escaping the content read from agent outputs before they are interpolated into the reconciliation report.\n- [COMMAND_EXECUTION]: The workflow involves executing local utility commands to perform integrity checks on multi-locale files.\n
Evidence: The skill uses grep -c '^## ' to verify header parity across locale variants and suggests running a repository-specific "anchor validator script" to check for broken links. These are functional verification steps but involve spawning local processes to inspect file contents.

agent-output-reconciler