The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs environment verification using shell commands such as java -version, dot -V, and command -v. It also uses the VS Code CLI (code --list-extensions, code --install-extension) to manage IDE extensions via the scripts/setup-vscode-server-based.sh script.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted sources within the project repository, such as .idea/ and .vscode/ configuration directories and glossary.adoc files. This creates a vulnerability surface where malicious instructions in these files could influence the agent's behavior, especially given its capabilities to execute commands and install software.
Ingestion points: Project-local configuration files (.idea/, .vscode/, workspace files) and documentation files (glossary.adoc, glossary.md).
Boundary markers: The instructions include a requirement to ask for user confirmation before changing plugins, extensions, or IDE settings, which serves as a manual checkpoint.
Capability inventory: The skill can execute shell commands for dependency checking (java, dot, test) and interact with the editor CLI to install extensions.
Sanitization: There is no evidence of explicit sanitization or validation of the content read from the project-local files before it is processed by the agent.
[DATA_EXFILTRATION]: The vscode-setup.md file contains a privacy warning regarding the myml.vscode-markdown-plantuml-preview extension, noting that it sends encoded diagram data to the public plantuml.com server for rendering. This is presented as a transparent disclosure of standard extension behavior rather than a malicious exfiltration attempt.

spec-loop-setup-doc-rendering