The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by interpolating untrusted task descriptions and codebase context directly into agent instructions.
Ingestion points: The variables {{TASK_DESCRIPTION}} and {{ADDITIONAL_CONTEXT}} are used in references/loop-coordinator-prompt.md to define worker tasks.
Boundary markers: The prompt templates lack explicit delimiters or instructions to prevent agents from obeying commands embedded within the input data.
Capability inventory: Agents have access to the teams tool for delegation and the git tool for modifying the local codebase.
Sanitization: No validation or sanitization of the provided task description is performed.
[COMMAND_EXECUTION]: The skill instructs agents to execute arbitrary build and test commands from the local working directory.
Evidence: In references/loop-coordinator-prompt.md, sub-agents are directed to "run build, tests, linting -- actual commands" and "Run tests to verify they pass". This results in the execution of scripts defined in the repository, which could be malicious if the repository content is untrusted.

hammer