The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from an external CLI tool, creating a potential surface for indirect prompt injection attacks.
Ingestion points: Data is ingested via the beans query command, which retrieves bean titles, status, type, and body content into the agent's context (SKILL.md).
Boundary markers: There are no explicit boundary markers or instructions provided to the agent to treat the content of the beans as untrusted or to ignore embedded instructions.
Capability inventory: The skill has broad capabilities including executing shell commands (build/lint/test scripts), updating state via the beans CLI, and initiating git commits via the committer skill.
Sanitization: The skill does not perform any sanitization or validation of the text content retrieved from the beans before the agent processes and acts on it.
[COMMAND_EXECUTION]: The skill is designed to automatically execute project-level scripts which can perform arbitrary operations.
Evidence: The "Pre-Completion Verification" section explicitly instructs the agent to run commands like npm run build, npm run lint, tsc --noEmit, and various test scripts (npm run test, bun run test, and E2E suites) defined in the project's configuration.

jb-beansloop