The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes arbitrary shell commands specified in the project's configuration file (.tw/config.json) within the platform and checks sections.
Evidence in scripts/tw_runtime/team/platform_script.py: The _execute function runs commands from config['argv'].
Evidence in scripts/tw_runtime/team/execution.py: The execute function uses subprocess.Popen to run commands defined in the checks section of the profile.
Risk: A malicious repository could define dangerous commands in these sections, leading to arbitrary code execution when the user runs tool commands like tw team run or tw team start.
[EXTERNAL_DOWNLOADS]: The skill can fetch content from arbitrary external URLs.
Evidence in scripts/tw_runtime/read.py: The fetch function uses urllib.request.urlopen to download data from URLs provided via the tw read --online command.
Evidence in scripts/tw_runtime/audit.py: The check_links function performs HEAD requests to verify URLs found in the project's knowledge base.
[INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it ingests Markdown files and structured data from the repository into the agent's context.
Ingestion points: scripts/tw_runtime/brief.py reads project knowledge entries (rule, decision, lesson) and includes them in the task brief.
Capability inventory: The skill has extensive subprocess execution capabilities and network access.
Boundary markers: Limited. While it uses HTML comments like  to delimit data, these can be spoofed in ingested content.
Sanitization: The tool performs structure validation but relies on the LLM to interpret text content safely.

team-knowledge