The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to build 'Task Contracts' by incorporating the 'repository's own instructions and test commands'. This ingestion of untrusted data from the local filesystem creates a surface for indirect prompt injection, where malicious content within a repository could influence the agent's behavior during the autonomous loop attempts.
Ingestion points: The agent reads instructions and test commands from the local repository files (SKILL.md).
Boundary markers: The instructions do not specify any delimiters or safety markers to separate repository content from agent instructions in the task contract.
Capability inventory: The skill utilizes opencode run for task execution, writes to the filesystem (.ralph-task/), and executes various shell commands (SKILL.md).
Sanitization: No explicit sanitization or filtering of the repository-provided instructions is mentioned.
[COMMAND_EXECUTION]: The skill utilizes several shell commands to manage logs, process execution, and monitoring.
Evidence: Usage of mkdir, ln, timeout, tee, wc, tail, and unlink within the bash snippets provided in SKILL.md.
Context: These commands are used to implement the loop supervisor and the stall watch monitor, operating on the .ralph-task/ directory.
[DYNAMIC_EXECUTION]: The skill generates and executes shell script snippets for two primary purposes: managing the opencode run loop and implementing a persistent stall watch monitor.
Evidence: The bash blocks in the 'Run attempts' and 'Arm the stall watch' sections of SKILL.md describe logic that is intended to be executed by the agent in its shell environment.
[EXTERNAL_DOWNLOADS]: The skill references external tools opencode and herdr for task execution and terminal management.
Evidence: Execution of opencode run and herdr pane commands in SKILL.md. These are treated as existing platform primitives within the skill's execution environment.

ralph-loop