The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to execute shell commands for installing external skills such as codex-loop, claude-loop, and ralph-prd. These commands utilize a repository-local Python script (scripts/install-external-skills.py) to manage extensions.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of external extensions from a defined registry (../../../references/external-skills.yaml). This is a documented feature of the agent's plugin architecture and relies on local scripts for execution.
[INDIRECT_PROMPT_INJECTION]: As the skill is intended to process user-supplied feature briefs and product requirements, it possesses an ingestion surface for untrusted data.
Ingestion points: Data is ingested through user-provided text for sections like 'Customer Problem', 'Market Opportunity', and 'User Stories' defined in references/prd-templates.md.
Boundary markers: The use of structured markdown templates provides implicit boundaries for different data fields.
Capability inventory: The skill can trigger command execution via the installation script and can chain to multiple other functional skills including frontend/onboarding-flows, quality-assurance, and reporting.
Sanitization: The skill instructions do not specify explicit sanitization or validation logic for the ingested content, relying on standard agent guardrails and the required human review policy defined in .skillmeta.yml.

prds