The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/invoke_peer.py invokes the claude or codex CLI tool using subprocess.run. This is the core functionality of the skill, and it is implemented securely by passing arguments as a list to avoid shell injection vulnerabilities. Binary locations are resolved using shutil.which and restricted to a specific set of allowed peer models.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data (handoffs and artifacts) and passes it to an external LLM agent for review, which constitutes an attack surface for indirect prompt injection. However, this is heavily mitigated by the skill's architecture.\n
Ingestion points: User-supplied handoff prompts and project files identified in the artifact_manifest and processed in scripts/invoke_peer.py.\n
Boundary markers: The skill encapsulates external data within clear delimiters (--- PRIMARY HANDOFF START --- and --- PRIMARY HANDOFF END ---) and includes explicit 'Hard rules' in the system prompt for the peer reviewer agent to prevent following instructions embedded in the data.\n
Capability inventory: The skill can execute the claude and codex CLI tools and perform file operations for state management (scripts/invoke_peer.py) and atomic skill installation (scripts/install_skill.py).\n
Sanitization: All output from the peer agent is validated against a strict JSON schema (references/review-output.schema.json). Furthermore, the peer agents are invoked with restricted toolsets (e.g., Read, Grep, Glob only), --safe-mode, and read-only sandboxing to prevent any file system mutation or state leakage.

dual-agent-collaboration