The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/goal_preflight.py script identifies and executes build, lint, and test scripts defined in a repository's configuration files (e.g., package.json, Cargo.toml). While this is standard for development workflows, it allows the agent to execute arbitrary commands if the repository configuration is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository configuration files and external tool outputs (e.g., gh pr view). This represents an attack surface where malicious instructions could be embedded in data.
Ingestion points: scripts/goal_preflight.py reads package.json and Cargo.toml. scripts/distill_goal_summary.py reads ledger.md files which may contain external content.
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when parsing these files.
Capability inventory: The skill can execute shell commands via subprocess.run in scripts/goal_preflight.py and scripts/new_goal_ledger.py.
Sanitization: scripts/distill_goal_summary.py implements a redact() function to remove potential secrets (API keys, tokens) from output artifacts.
[DYNAMIC_EXECUTION]: The skill uses subprocess.run to execute commands that are dynamically constructed based on the project environment (e.g., detecting whether to use npm, yarn, pnpm, or bun). The scripts correctly use list-based arguments for subprocess.run, which prevents common shell injection vulnerabilities.

goal-to-release