The Agent Skills Directory

[COMMAND_EXECUTION]: The generated wizard utilizes the system shell to perform automated checks, such as verifying the presence of tools like Git and Go. It also executes platform-specific utilities for opening URLs (e.g., open, rundll32) and interacting with the system clipboard (e.g., pbcopy, clip).
[DYNAMIC_EXECUTION]: The skill's primary purpose is the generation and execution of Go source code. It provides a template runtime and generates custom step definitions, which are then compiled or executed using the local Go toolchain.
[INDIRECT_PROMPT_INJECTION]: The skill implements a surface for indirect prompt injection by collecting human input through interactive TUI forms. If an authoring agent generates steps that interpolate this user input directly into shell commands within the Check helper, it could lead to local command injection.
Ingestion points: User input is captured via Ctx.Ask, Ctx.AskSecret, and Ctx.Select in template/runtime.go.
Boundary markers: None are utilized in the shell command execution path.
Capability inventory: The runShell function executes arbitrary strings via sh -c or cmd /C. The wizard also performs file writes via WriteEnv and interacts with the GitHub CLI via SetSecret.
Sanitization: While user input is trimmed for whitespace, the runtime.go template does not include specific shell-escaping logic for commands executed in the Check phase.

crank-wizard