The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted data from the external BKD REST API ($BKD_URL). This data is then used to influence the agent's behavior and the state of orchestrated tasks.
Ingestion points: Data enters the agent's context through several API endpoints, most notably /logs/filter (which retrieves assistant and system logs from other subtask issues) and /messages/items (which retrieves user-provided decisions and notifications).
Boundary markers: The skill uses structural markers like [dag-state] and [L2-plan-snapshot] for internal state management. However, it lacks explicit, hardened boundary markers or instructions to disregard potential commands embedded within the logs or messages retrieved from the external server.
Capability inventory: The skill possesses a powerful set of capabilities, including executing shell commands (git, jq, sed, setsid, nohup), performing network requests via curl, and managing application-level scheduled tasks (crons) via the BKD API.
Sanitization: The skill strictly follows a 'never-inline rule,' using jq to safely construct JSON bodies for API requests, which effectively prevents shell injection in outgoing data. However, there is no explicit sanitization or filtering of the content retrieved from the BKD API to prevent the agent from obeying embedded instructions.
[COMMAND_EXECUTION]: The skill uses shell commands and utility tools (git, jq, sed) to manage local repositories and workspace state. While these tools are used for their primary purpose in development workflows, they provide the agent with the ability to modify the local file system and repository history based on instructions that may be influenced by the external BKD server.

bkd