The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes task-specific instructions and verification commands, presenting a potential surface for indirect prompt injection.
Ingestion points: External task data (description, steps, verification commands) is loaded into the agent context via manage-tasks read in SKILL.md.
Boundary markers: Task content is interpolated into the workflow without explicit delimiters or boundary markers.
Capability inventory: The skill has access to potentially dangerous tools including bash command execution and file system modification tools (Write, Edit).
Sanitization: The risk is mitigated by the 'Enforcement' section in SKILL.md, which prohibits dangerous shell patterns (compound commands, subshells, polling loops), and by the requirement for human intervention via AskUserQuestion before committing scope deviations.
[COMMAND_EXECUTION]: Shell command execution is performed for task verification. The skill uses a dedicated helper script scripts/inject_project_dir.py to rewrite commands safely using shlex for tokenization and joins. Execution is subject to strict enforcement rules requiring single, synchronous, and non-compound commands to prevent injection and ensure process observability.

execute-task