The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands via two Python scripts (collect_plan_evidence.py and generate_plan_summary.py) but does so in a highly controlled manner. It mandates using a trusted absolute path for the Python interpreter and provides fixed arguments. Evidence from SKILL.md demonstrates strict isolation: /absolute/trusted/python3 -I <skill-path>/scripts/collect_plan_evidence.py.
[DATA_EXFILTRATION]: The skill explicitly forbids network access and link fetching. It treats source documents as untrusted data and implements strict boundary markers to prevent the agent from treating document text as instructions. The document reader (collect_plan_evidence.py) is restricted to local regular files with supported extensions (.md, .markdown, .txt) and enforces size limits.
[PROMPT_INJECTION]: The skill includes comprehensive 'Treat Documents As Untrusted Data' guidelines. It instructs the agent to ignore prompt-like text within documents and explicitly routes requests for critique or execution to separate workflows, preventing the summarizer from being used for unintended actions.
[DYNAMIC_EXECUTION]: While the skill generates HTML, the generator script (generate_plan_summary.py) performs rigorous validation and sanitization of the input Markdown. It uses html.escape and JSON serialization with character escaping to prevent cross-site scripting (XSS) or other injection vulnerabilities in the final self-contained report.
[PRIVILEGE_ESCALATION]: The skill operates under a least-privilege model. It forbids directory scanning, environment variable expansion, and any operations outside the specified evidence boundary.

plan-summary