The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute git commands and calls the local project executor (.plan/execute-script.py) for state management operations. These calls use the absolute path to the Python interpreter (sys.executable) and execute lists of arguments rather than shell strings, preventing typical command injection vulnerabilities.- [PROMPT_INJECTION]: The subagent_dispatch operation (in scripts/_claude_runtime_impl.py and scripts/opencode_runtime.py) interpolates context data into subagent prompts, creating a surface for indirect prompt injection.
Ingestion points: The context dictionary argument in the subagent_dispatch methods.
Boundary markers: Minimal; uses a ## Context header but lacks explicit delimiters or instructions to ignore embedded commands.
Capability inventory: The parameters are used to invoke the platform's native subagent tools (Task or task).
Sanitization: Values are converted to strings and joined without escaping.
[SAFE]: The skill implements a security-enhancing PreToolUse enforcement hook (scripts/claude_pretooluse_hook.py) that monitors and blocks dangerous behaviors such as shell loops, command substitution, and unauthorized edits to the project executor.

platform-runtime