The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard shell utilities for local project management.
Evidence includes the use of find, grep, mkdir, date, and rm -rf to manage directories and files within the .astroshot/ worktree.
It checks for the presence of the vendor's CLI tool using command -v archdev.
[EXTERNAL_DOWNLOADS]: Interacts with the archdev CLI tool if available on the host system.
Commands like archdev shots stories new and archdev shots stories list are used to manage story metadata and lifecycle.
[DATA_EXFILTRATION]: Supports an opt-in upload feature for web-based review.
The command archdev shots stories upload <slug> sends user story data to the ArchCode web UI for human review. This is an intended capability of the vendor-provided toolset.
[INDIRECT_PROMPT_INJECTION]: The skill operates by processing and executing authored markdown scenarios (prompt.md).
Ingestion points: Reads local prompt.md files and log.jsonl files from the .astroshot directory.
Boundary markers: Uses structured JSONL for log data, providing natural schema boundaries for run outputs.
Capability inventory: Includes file system modification, shell command execution, and network upload capabilities.
Sanitization: The instructions explicitly direct the agent to use isolated browser profiles and ephemeral fixtures, and strictly advise against placing secrets in prompt files, recommending environment variable references instead.

user-story