The Agent Skills Directory

Command Execution: The skill performs a local shell command (grep -r "STUB" <dir> | wc -l) to count implementation stubs. This is a standard developer workflow used here to provide a status metric.
Indirect Prompt Injection Surface: The skill reads and reports content from external files, creating a potential vector for instructions embedded in data. (1) Ingestion points: Files located in the .porting/ directory (e.g., goal-*.md, porting-memory.md). (2) Boundary markers: Absent in the prompt, although the skill includes a strong instructional constraint to remain read-only. (3) Capability inventory: File read access and shell command execution (grep, wc). (4) Sanitization: The skill does not sanitize or validate the content of the files before outputting their information to the user.

porting-status