The Agent Skills Directory

[COMMAND_EXECUTION]: The archdev shots pty command enables the execution of terminal programs defined in YAML or JSON fixture files. The skill documentation explicitly warns that these programs run with the user's permissions and advises reviewing any fixture not authored by the user before execution.
[DYNAMIC_EXECUTION]: The skill renders React and Ink components by executing their source code via archdev shots react and archdev shots ink. It also supports running custom Playwright scripts for browser recordings. These features are essential for capturing UI states but involve the execution of provided code modules.
[DATA_EXFILTRATION]: Media captures (screenshots and movies) are uploaded to the ArchDev web platform using the archdev shots upload command. This process is governed by a user-controlled setting (shots-upload) and requires an active user session established through archdev auth login.
[INDIRECT_PROMPT_INJECTION]: The skill processes external feedback and user story data that could potentially contain malicious instructions.
Ingestion points: Reviewer feedback is read from review.json via archdev shots status, and story steps/prompts are read from prompt.md and log.jsonl (as described in SKILL.md).
Boundary markers: The agent is explicitly instructed to report all reviewer comments to the user and address them through manual iterations, creating a human-in-the-loop boundary.
Capability inventory: The skill utilizes archdev shots subcommands (in SKILL.md) for file system operations, component rendering, and network-based media uploads.
Sanitization: No specific sanitization or filtering of the ingested feedback text is mentioned in the instructions.
[EXTERNAL_DOWNLOADS]: The troubleshooting section describes the manual installation of standard Node.js development packages (such as tsx, vite, and playwright-core) into a helper directory. The skill instructs the agent to ask for user permission before these installations are performed.

shots