The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system commands including git rev-parse, git remote -v, jq, and python3 -m json.tool. These commands are used for repository resolution and JSON syntax validation. The instructions explicitly direct the agent to quote paths safely to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted repository files such as README.md, package.json, and AGENTS.md to infer workspace settings and setup commands.
Ingestion points: Reads project documentation and metadata files (e.g., README.md, package.json) to identify build scripts and setup procedures.
Boundary markers: Implements a mandatory user-review loop. The agent must present the full proposed JSON and wait for explicit user approval before writing any files.
Capability inventory: The skill has the capability to write to the .agent-work/ directory and modify .gitignore. It does not execute the inferred setup commands itself.
Sanitization: The skill requires the agent to explain and justify every inferred setup command to the user, providing a manual sanitization step via human review.
[DATA_EXPOSURE]: The skill checks for the existence of sensitive environment files (e.g., .env, .env.local) to include them in workspace copy rules. However, it contains a strict directive: 'Never read the contents of candidate secrets; check only whether names... exist.'

configure-workspaces