The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bootstrap script (bootstrap_plugin.py) and a generated local shim (.plan/execute-script.py) to orchestrate the execution of other scripts and skills within the project environment.
The determine_mode.py script executes a sibling script generate_executor.py via subprocess.run to perform health and staleness checks. This execution uses a structured list of arguments rather than a shell string, minimizing injection risk.
[PROMPT_INJECTION]: The skill exhibits an attack surface for Indirect Prompt Injection as it ingests and processes untrusted project data (such as build files, Maven profiles, and directory structures) to derive project architecture and configuration.
Ingestion points: determine_mode.py, extension_discovery.py (via architecture discover), and crawl_module_derived consume filesystem data.
Boundary markers: The skill relies on structured TOON output and specific tool protocols to maintain data/instruction separation.
Capability inventory: The skill can write to the .plan/ directory, modify .gitignore, and update .claude/settings.json permissions.
Sanitization: External data is primarily used for classification and structural mapping rather than being directly interpolated into executable commands or sensitive prompts without verification.
[SAFE]: Credential management for external tools (e.g., SonarCloud) is handled by instructing the user to manually edit local files to provide secrets, avoiding hardcoding or automated exfiltration of sensitive tokens.

marshall-steward