The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an inherent attack surface by ingesting implementation plans and specification documents (untrusted repository data) that may contain instructions for verification commands.
Ingestion points: Plan documents and work descriptions are parsed in references/input-triage.md and references/work-intake.md.
Boundary markers: The skill uses 'bounded unit packets' and distilled implementation briefs (defined in references/cross-model-execution.md) to limit the context shared with external workers.
Capability inventory: The skill possesses significant capabilities, including arbitrary command execution via subprocess.run in scripts/unit_workspace_transaction.py and detached process management in scripts/peer-job-runner.py.
Sanitization: A dedicated redaction mechanism (redact_stream) is implemented in scripts/cross-model-work.sh to mask secrets in logs based on a configurable redaction file.
[COMMAND_EXECUTION]: The skill facilitates the execution of developer-defined commands for testing and verification.
Evidence: scripts/unit_workspace_transaction.py uses subprocess.run to execute commands supplied by implementation plans.
Mitigation: The job runner (scripts/peer-job-runner.py) uses an 'assume-untrusted' posture, verifying that every state file and directory is owned by the current effective user and implementing restrictive umasks and file modes.
[DYNAMIC_EXECUTION]: The skill orchestrates workflows across different AI models and harnesses by dynamically invoking local CLI tools like codex, claude, and cursor-agent.
Evidence: scripts/cross-model-work.sh constructs and executes argument arrays for various external model providers.
Mitigation: Command arguments are validated against strict contracts (e.g., ROUTE_CONTRACTS in scripts/unit_workspace_state.py) to prevent shell injection or unauthorized parameter overrides.

ce-work