The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/roles.py uses importlib.import_module to load submodules from the _roles directory into a dynamically generated namespace (aliased via uuid). This technique is used to prevent module caching issues but involves runtime assembly of executable code.
[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/_roles/mode.py to execute git commands for repository analysis. Additionally, SKILL.md contains instructions for an 'ACP fallback' which involves executing shell commands with specific environment variables (ELECTRON_RUN_AS_NODE=1) to bridge MCP tools to the terminal.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it is designed to process external, potentially untrusted data.
Ingestion points: Processes transcript files (SKILL.md), webhook payloads (webhooks.md), and pull request activity/comments (watching.md).
Boundary markers: Documentation in webhooks.md indicates the platform wraps incoming data in <webhook-data-ID> frames to distinguish it from instructions.
Capability inventory: The skill can spawn child tasks (delegate_task), schedule recurring work (schedule_task), and send messages across threads.
Sanitization: The skill provides explicit developer warnings in webhooks.md to avoid directly using payload strings in commands or paths, recommending that agents only act on allowlisted identifiers found within the data.

pstack-runtime