The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes git status --short during the session start to verify the workspace state. This is a standard and low-risk developer operation.
[INDIRECT_PROMPT_INJECTION]: The skill's orchestration logic is heavily dependent on the content of various workspace files, which creates a surface for indirect prompt injection.
Ingestion points: The agent reads state and policy information from multiple project files, including planning/manifests/Qx.json, planning/session_config.json, qx_method_card.md, qx_decisions.jsonl, risk_probe_summary.json, run_summary.json, and AGENTS.md.
Boundary markers: The instructions do not provide explicit delimiters or warnings to the agent to treat the content of these files as untrusted data, meaning embedded instructions within these artifacts could influence the agent's behavior.
Capability inventory: The skill possesses the capability to read files throughout the workspace structure and execute shell commands (e.g., git).
Sanitization: There are no specified procedures for validating or sanitizing the content of the ingested JSON or Markdown files before they are used to determine next actions and gate progression.

workflow-orchestrator