The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user content from GitHub/GitLab issues in autonomous-dev.sh and autonomous-review.sh.
Ingestion points: Issue title, body, and comments are fetched via itp_read_task and itp_list_comments.
Boundary markers: User content is explicitly wrapped in <user-issue-content> XML-style tags within the agent prompts.
Capability inventory: The agent can perform state transitions, post comments, create pull requests, and push code to the repository (via the provider and git wrappers).
Sanitization: The prompts contain clear, high-priority instructions for the agent to treat tagged content as a specification only and to ignore any embedded shell commands or override instructions.
[COMMAND_EXECUTION]: The skill relies on executing system commands (bash, curl, git, gh, aws) and spawning background processes via setsid and nohup to manage agent lifecycles. All external inputs flowing into commands (especially in the AWS SSM remote backend) are strictly validated against allow-lists and character-rejection regexes to prevent shell injection.
[PERSISTENCE]: The install-gc-timer.sh script installs periodic tasks via cron (Linux) or launchd (macOS). This persistence is used to run the adt-gc.sh utility, which reclaims residue from dead process lanes. The installer is idempotent and uses specific markers to avoid interfering with other system tasks.
[PRIVILEGE_ESCALATION]: The lib-ssm.sh library builds commands using sudo -u ${SSM_REMOTE_USER} to execute agent wrappers on remote AWS EC2 instances. The target user and shell are validated against strict alphanumeric regexes to prevent breakout or unauthorized escalation.

autonomous-dispatcher