The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill is instructed to locate a specific directory for the 'cs' skill at runtime and execute a Python script (scripts/bootstrap.py) within that directory. This execution of code from a path computed during the session is a dynamic execution pattern.
Evidence: Found in SKILL.md in the section describing the execution of scripts/bootstrap.py --root <project-root> --check after finding the usable directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files and task records to generate a report, while possessing the capability to execute shell commands. This creates a surface where malicious content in a project file could attempt to influence the agent's behavior during the analysis phase.
Ingestion points: Reads project files, task records, and the current conversation history as mentioned in SKILL.md.
Boundary markers: The skill does not define strict boundary markers or delimiters for the ingested data to prevent it from being interpreted as instructions.
Capability inventory: The skill can execute scripts/bootstrap.py, status, doctor, audit, drift, task-files, and brief. It also has file-writing capabilities to /tmp/cs-analysis.md (Evidence in SKILL.md).
Sanitization: The skill instructions mention anonymizing sensitive names and using relative paths in the final report, but do not specify sanitization of the input data before processing.
[COMMAND_EXECUTION]: The skill invokes several diagnostic and status tools (status, doctor, audit, drift, task-files, brief) as part of its analysis process. These tools interact with the local project environment and file system.
Evidence: Listed as optional auxiliary checks in the SKILL.md file under the section '以任务发生时的依据为准'.

cs-analysis