The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within its protocol runtime and planning logic to execute local scripts and interface with Git. Specifically, it retrieves repository identity metadata (remote URL and current HEAD) and executes the seal_plan.py script as defined in the skill's manifest. These operations are scoped to the local environment and intended for project tracking.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic module loading (__import__) to load optional Tree-sitter grammar modules (such as tree_sitter_rust or tree_sitter_go). This allows the skill to perform structured fact verification across different programming languages without requiring all parsers to be installed as hard dependencies. The loading is restricted to a hardcoded mapping of file extensions to specific grammar packages.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content and external planning requests, presenting a potential surface for indirect injection.
Ingestion points: The agent reads implementation details from the target repository, trusted planning requests (request_file), and agent-authored drafts (draft_file).
Boundary markers: The skill instructions explicitly mandate that repository content be treated as 'untrusted evidence' rather than instructions. The v6 plan contract uses Markdown comments to separate machine-verifiable metadata from human-readable content.
Capability inventory: The skill can read repository files, query Git metadata, and write the verified plan to a file path designated in the manifest.
Sanitization: The plan_runtime.py script enforces a mechanical seal by verifying that cited anchors and line ranges in the plan exactly match the repository state, preventing the agent from hallucinating or being misled by malicious comments in the source code.

plan-change