The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands such as git, test runners, and linters. This is integral to its purpose of validating coding tasks. In the record-layer (v6/v7), these executions are restricted by an 'allowed_command_classes' allowlist defined in the plan contract.
[EXTERNAL_DOWNLOADS]: The onboarding and upgrade flows utilize npx skills add and git clone to install supplementary tools (e.g., ai-diff-reviewer, coding-agents-kit, herdr-peers). These downloads are pinned to specific version tags and originate from the author's own repositories (DailybotHQ), which is standard behavior for a vendor-provided toolset.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and reasoning about untrusted data, including repository source code, documentation, and tool outputs. This creates a potential surface for indirect injection.
Ingestion points: execute/SKILL.md and resume/SKILL.md read arbitrary codebase files and tool outputs into the agent's context.
Boundary markers: Present. execute/SKILL.md contains a specific 'Untrusted-content rule' which explicitly instructs the agent to treat repository content as data to reason about, not instructions to obey.
Capability inventory: The skill uses subprocess.run (via shared/ledger.py, shared/resources.py, etc.) and the Write/Edit tools to modify the repository and execute gates.
Sanitization: Absent. The skill relies on the agent's reasoning capabilities and the explicit 'Untrusted-content rule' instruction to mitigate injection risks rather than mechanical sanitization of the input text.

deepworkplan