The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts during activation and initial setup to manage its persistent memory environment. These scripts (scripts/wake.py and scripts/init-sanctum.py) are used to load session context and scaffold the storage directory. These operations are performed using the uv tool and are restricted to the local project and skill directories.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data, specifically the user's project code and past session logs, to provide technical feedback and curate long-term insights. This is an inherent part of its functionality as a coding assistant.
Ingestion points: The skill reads files from the {project-root} and the sessions/ directory within its sanctum (documented in PULSE.md and references/memory-guidance.md).
Boundary markers: The skill uses markdown headers and templates to structure its memory, though no explicit adversarial delimiters for ingested code are noted.
Capability inventory: The skill possesses file-writing capabilities (within its sanctum) and the ability to trigger internal scripts via subprocesses.
Sanitization: No specific sanitization or filtering logic for external code content is described beyond standard LLM processing.
[SAFE]: The skill explicitly defines 'Deny Zones' in its core philosophy, prohibiting access to .env files, credentials, secrets, and tokens (as seen in assets/CREED-template.md). All network-like operations mentioned are directed at local file system maintenance and do not involve external exfiltration.

bmad-agent-code-coach