The Agent Skills Directory

[PROMPT_INJECTION]: The skill's 'Dual-Loop' architecture is susceptible to indirect prompt injection. It reads context files and instructions using the agent_orchestrator.py script and interpolates them into markdown 'Strategy Packets' without sanitization. \n
Ingestion points: Files and strings provided via --context and --instructions arguments to the packet and correct commands.\n
Boundary markers: Weak. The STRATEGY_TEMPLATE uses standard Markdown headers which do not reliably isolate instructions from potentially malicious untrusted data.\n
Capability inventory: The Inner Loop agent is granted access to the terminal, editor, and test runners to execute tasks based on the generated packets. agent_orchestrator.py executes git commands via subprocess.run.\n
Sanitization: Absent. No escaping or validation is performed on the content of context files before prompt interpolation.\n- [PROMPT_INJECTION]: The skill documentation in SKILL.md explicitly references the --dangerously-skip-permissions flag for the claude-cli-agent, which encourages bypassing standard security prompts and user authorization checks during sub-agent execution.\n- [COMMAND_EXECUTION]: The agent_orchestrator.py script uses subprocess.run to execute system commands such as git status. While the command list is currently limited, the execution context (working directory) is derived from user-provided path arguments.\n- [COMMAND_EXECUTION]: Reference documentation in cli-agent-executor.md promotes shell command patterns that pipe data between the filesystem and external CLI engines (e.g., cat <PERSONA> | <CLI_ENGINE> < <INPUT> > <OUTPUT>), which increases the risk of malicious shell instruction execution if file paths or persona prompts are manipulated.

orchestrator