The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The extension discovery logic in extension_discovery.py uses importlib.util to dynamically load and execute Python code from discovered extension.py files. This is the primary mechanism for the framework's extension system and is restricted to local marketplace bundles and the plugin cache.
[COMMAND_EXECUTION]: The skill facilitates the generation and execution of build-system commands (e.g., Maven, npm, Gradle) via subprocess as part of its build utility set. These commands are constructed from discovered project metadata and are used for build verification.
[PROMPT_INJECTION]: The skill processes metadata and instructions from external SKILL.md files during extension discovery. To mitigate risks associated with untrusted data, the system implements strict path-traversal guards and schema validation in its configuration parsers.

extension-api