The Agent Skills Directory

[COMMAND_EXECUTION]: The state tool assets/release.py uses subprocess.Popen to run project-specific commands for building, deploying, and checking software health. This is the primary purpose of the skill. To mitigate risks, the tool implements a 'grant' system that validates actions against human-approved policies and refuses to execute production commands in headless or unattended environments.- [DYNAMIC_EXECUTION]: The test suites (assets/test_release_e2e.py, assets/test_release_stage.py, and assets/test_release_prod.py) use python -c to execute small logic snippets. These snippets perform tasks like appending to marker files and fetching content via urllib.request. This behavior is confined to the offline test infrastructure and targets local loopback addresses.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from two main ingestion points: the project release recipe (.release/recipe.json) and evidence files from external verification skills. It provides strong boundary markers via its contract logic, which requires specific digests and state transitions before acting on processed data. Capability inventory includes full shell access through project recipes, which is sanitized by enforcing structured argv lists and prohibiting shell interpretation.- [EXTERNAL_DOWNLOADS]: The skill performs automated network requests during version probing and health checks. While these are user-configured, the included test assets demonstrate this functionality by querying local HTTP servers to verify software state during the release lifecycle.

release-conductor