The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes external CLI tools to perform its orchestration tasks. It invokes the GitHub CLI (gh) to verify repository access and retrieve commit SHAs, and it chains to other pipeline skills including skf-quick-skill, skf-export-skill, skf-verify-stack, skf-refine-architecture, and skf-create-stack-skill. These executions are performed via subprocess calls within Python scripts and instructions to the agent in markdown step files (Evidence: scripts/campaign-provenance.py, references/step-05-skill-loop.md, references/step-06-batch.md, references/step-10-export.md).
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from campaign manifests, repository URLs, and standing directive files (_campaign-directive.md). This content is interpolated into the kickoff templates for sub-skills, creating a surface where malicious instructions in a directive file could influence the agent's behavior during sub-skill generation.
Ingestion points: Operator-supplied manifests (step-01), campaign-wide directive files (step-02, step-05), and repository metadata.
Boundary markers: Uses markdown headers (e.g., '## Standing Directive') in templates/kickoff-template.md to delimit external content, but does not employ strict escaping or sandboxing.
Capability inventory: The agent has capabilities to read/write files, execute shell commands, and interact with the GitHub API via CLI tools.
Sanitization: There is no evidence of active sanitization or filtering of the content read from directive files before prompt interpolation.
[DYNAMIC_EXECUTION]: The script scripts/campaign-validate-pins.py uses importlib to dynamically load a shared validation module from a relative path on the local file system (Evidence: scripts/campaign-validate-pins.py).

skf-campaign