The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The bootstrap scripts (scripts/bootstrap.sh and scripts/bootstrap.ps1) fetch the ArchDev installer from the vendor's official GitHub repository (ArchAstro/archdev). The download is pinned to a specific commit hash (a530d21dd04eaed5742b8ad7daf9140a3ee2ef0f) to ensure integrity.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded installation scripts to set up or update the ArchDev CLI. The scripts verify the integrity of the downloaded file using a hardcoded SHA-256 hash (f838ca85... for shell, f767834c... for PowerShell) before execution, providing a strong defense against supply chain attacks.
[COMMAND_EXECUTION]: The skill makes extensive use of the archdev CLI for core functionality, including authentication (auth login), task management (tasks create, tasks update), and status monitoring. It also executes local scripts via the bootstrap process.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user conversations and external coding-harness plans to draft task graphs, which can lead to instructions being inadvertently followed if they are embedded in the source data.
Ingestion points: Conversation history and external harness-provided plans are used as the primary source for drafting task nodes.
Boundary markers: The skill does not use specific delimiters during the initial drafting phase, but it instructs the agent to use a secondary subagent with a restricted prompt to validate individual task nodes in isolation.
Capability inventory: The skill has the ability to execute shell commands via the archdev CLI and write structured task data to the local file system (plans/task-review.json).
Sanitization: The instructions explicitly warn the agent to keep context concise and omit secrets or customer data from the drafted task metadata.

tasks