The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The orchestrator's primary function is to read specifications, tickets, and handoff files to delegate work. These files serve as the 'source of truth' and are often generated by other agents or sessions, creating a vulnerability where malicious instructions embedded in these files could be executed by the orchestrator.
Ingestion points: The skill reads data from .handoff/*.md, .efforts/*/spec.md, and .efforts/*/issues/*.md (as documented in SKILL.md and folder-standard.md).
Boundary markers: The instructions do not specify the use of delimiters or warnings to treat ingested content as data rather than instructions.
Capability inventory: The agent can delegate tasks to sub-agents, execute file operations (mv), perform git operations (git worktree, git rm, git mv), and interact with external trackers or pull request systems.
Sanitization: There are no mentioned processes for sanitizing or validating the contents of the specification or ticket files before the agent acts upon them.
[COMMAND_EXECUTION]: The skill instructions include the use of shell and git commands for workspace management and file cleanup.
Evidence: The skill references git worktree, mv, git rm, and git mv. It also notes a safety restriction where rm -rf is generally refused by environment permission checks, advising the agent to use mv to a .scratch/ directory instead.

orchestrating