The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends that the agent prompt the user to install additional tools if they are not present. Specifically, it suggests installing system-design from wondelai/skills and naming-analyzer from softaworks/agent-toolkit using the npx skills add command. These are external repositories provided as recommendations for the user to manually install.
[COMMAND_EXECUTION]: The plan skeleton requires the inclusion of "Exact run commands" for verification and "commit points". These commands are intended for documentation and manual execution by a human or a downstream agent following the generated plan, rather than being executed by the skill itself during its runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as technical specifications and tickets. While it lacks explicit instructions to ignore embedded commands within those inputs, it mitigates risk through its structural skeleton and its "Core rule," which prohibits copy-pastable implementation code and requires all logic to be presented as pseudocode or diagrams. Evidence: 1. Ingestion points: Processes user-provided specs or tickets (SKILL.md). 2. Boundary markers: Relies on a rigid plan skeleton (specific headers like Header, Tasks, Test-first steps) to isolate external content. 3. Capability inventory: Invokes external design and visual tools via the Skill interface. 4. Sanitization: Prohibits raw code blocks in favor of behavioral assertions and call trees.

to-plan