The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The bootstrapping scripts (bootstrap.sh and bootstrap.ps1) download the ArchDev installer from the vendor's official GitHub repository. The scripts implement security best practices by verifying the SHA256 integrity hash of the downloaded installer before execution and using private temporary directories for the download.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local browser review sessions, creating a surface for indirect prompt injection.
Ingestion points: Feedback is received as a JSONL stream of comments from the browser review workspace during the inspect local process defined in SKILL.md.
Boundary markers: The process uses the JSONL event format (ready, drafts_changed, submitted) to structure incoming data.
Capability inventory: The agent can perform file writes, Git operations, and execute workflows using the archdev CLI tool as described in SKILL.md and references/workflows.md.
Sanitization: The skill contains explicit instructions in SKILL.md for the agent to treat comment text as 'review evidence' rather than authoritative instructions to run commands or change scope, mitigating the risk of malicious commands being injected through review feedback.

inspect