The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in references/cli-tools/cymbal.md provides installation instructions using a piped remote script pattern (irm ... | iex) from an untrusted GitHub repository (1broseidon/cymbal). This pattern is highly dangerous as it executes unverified code directly from the internet.
[DYNAMIC_EXECUTION]: The skill uses the source command to load shell scripts from dynamically computed relative paths (e.g., ../../stelow-workflow-orchestrator/references/cli-tools/read-config.sh). This creates a dependency on external skill files and could be exploited if the directory structure or linked files are compromised.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from multiple external sources without sanitization or boundary markers, including stelow.json, context/blocking-constraints.md, context/tech-preview.md, and context/existing-features.md. This data is then used to inform product planning and shaping decisions.
Ingestion points: stelow.json, context/blocking-constraints.md, context/tech-preview.md, context/existing-features.md, and user-provided problem statements.
Boundary markers: None identified in the instructions for processing these files.
Capability inventory: Execution of shell commands, interaction with the subagents tool, and usage of the ask tool for user interaction.
Sanitization: No escaping or validation of the ingested content is performed before it influences the agent's logic.
[COMMAND_EXECUTION]: The skill executes various shell commands and Node.js snippets (e.g., node -e "...") to process project configuration and codebase information.

stelow-workflow-shape-up