The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of supplementary coding skills from external repositories, specifically those belonging to Matt Pocock and Karpathy-related projects (e.g., github.com/mattpocock/skills, github.com/multica-ai/andrej-karpathy-skills). These are presented as optional enhancements to the core engineering discipline.
[COMMAND_EXECUTION]: The skill includes instructions for the agent to execute shell commands for its own installation (npx skills add) and for verifying the integrity of its workspace (python3 scripts/validate.py). The provided validation script performs safe operations such as checking for the presence of required files, verifying YAML frontmatter, and scanning for common secret patterns (e.g., AWS keys, GitHub tokens) to prevent accidental exposure.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function involves processing untrusted external data, such as project source code and AI-generated code patches.
Ingestion points: The agent reads project source code, test results, and user-provided code/diffs as part of the implementation and review workflows (SKILL.md, references/mode-routing.md).
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed files are specified.
Capability inventory: The skill is designed to allow the agent to read/write files and execute testing or validation commands (SKILL.md).
Sanitization: There are no explicit sanitization or validation steps mentioned for the content of the files ingested during the coding process.

coding-discipline