The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a vendor-provided initialization script (resolve_customization.py) during the activation phase to resolve project-specific settings and workflow parameters.
[COMMAND_EXECUTION]: The skill is designed to execute shell commands defined in the customize.toml configuration file as part of its lifecycle hooks (activation_steps_prepend, activation_steps_append, and on_complete). These commands are intended for workflow automation and are scoped to the project environment.
[PROMPT_INJECTION]: The skill processes untrusted external data (logs, diagnostic archives, and issue tracker content), which introduces a risk of indirect prompt injection. The skill implements a robust evidence-based framework to mitigate this, including:
Ingestion points: Untrusted data is ingested from log files, diagnostic archives, and issue tracker tickets.
Boundary markers: The instructions mandate delegating the processing of large or raw external data to subagents, preventing raw content from being read directly into the parent agent's context where it could influence behavior.
Capability inventory: The agent possesses capabilities for shell execution (via workflow hooks), file system interactions (git, grep, write), and local Python script execution.
Sanitization: The skill performs sanitization on user-provided 'slugs' (restricting them to lowercase alphanumeric characters and hyphens) to prevent path traversal vulnerabilities during file generation.

gds-investigate