The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to execute implementation plans from external files (plan.md), which are treated as a 'source of truth'. This presents an attack surface where malicious instructions in a plan could influence the agent or its subagents.
Ingestion points: The primary input is the implementation plan file (plan.md); secondary inputs include subagent reports (task-<N>-report.md) and external specifications (Spec: line).
Boundary markers: The skill relies on procedural 'Hard Rules' (e.g., 'Evidence before claims') and multi-stage review processes (per-task, final, and merge) to verify correctness, though these do not prevent adversarial instructions.
Capability inventory: The skill possesses extensive capabilities including repository management via git, file system modification, and execution of arbitrary shell commands for testing and building.
Sanitization: There is no evidence of sanitization or escaping of the content ingested from the plan files before it is processed or used in subagent briefs.
[COMMAND_EXECUTION]: The skill frequently executes shell commands for repository analysis (git diff, git log, git status, git rev-parse) and project-specific tasks (testing, linting, building) as defined in the project orientation and plan files.
[DYNAMIC_EXECUTION]: As part of its development workflow, the skill creates, modifies, and executes code (RED→GREEN→REFACTOR cycles). It specifically utilizes 'probes'—temporary scripts created to verify factual questions about the code—which are executed and then deleted, constituting runtime code generation and execution.

crank-execute