The Agent Skills Directory

[COMMAND_EXECUTION]: The workflow and its supporting Python scripts frequently execute system commands to orchestrate the skill production pipeline.
Scripts like campaign-provenance.py invoke the GitHub CLI (gh) to verify repository access and retrieve commit SHAs.
Workflow steps use uv run to execute internal scripts for state validation, manifest parsing, and report generation.
The step-05-skill-loop.md execution involves running other skills in the pipeline (Analyze, Brief Synthesis, etc.).
These executions are part of the core functionality and generally avoid unsafe shell interpolation by passing arguments as lists.
[DYNAMIC_EXECUTION]: The skill employs dynamic loading techniques to share logic across the framework.
scripts/campaign-validate-pins.py uses importlib.util to load a shared validation script from a relative path outside its own directory.
An optional on_complete hook in the configuration allows the execution of a user-defined command after campaign completion.
[INDIRECT_PROMPT_INJECTION]: The orchestrator processes data from external sources that is later interpolated into prompts for other skills.
Ingestion points include operator input, manifest files, and repository metadata.
scripts/campaign-render-kickoff.py performs string substitution on templates to create instructions for sub-skills.
The risk is mitigated by deterministic validation scripts and schemas that enforce structure on the ingested data.

skf-campaign