The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as grep to analyze the repository's file structure, routing configuration, and authentication helpers to ensure the new scratchpad integrates with existing project conventions.
[EXTERNAL_DOWNLOADS]: The documentation references installation via npx skills add and git clone from the author's public GitHub repository (github.com/drmrduck/skills). These are standard installation procedures for the provided vendor.
[PROMPT_INJECTION]:
Ingestion points: The agent reads the local repository's source code (SKILL.md, Workflow steps 1 and 2) to detect framework types and existing route patterns.
Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying potentially malicious instructions embedded in the project files it analyzes.
Capability inventory: The agent is granted the ability to write new source code files (e.g., the scratchpad route and access module) and execute local search commands.
Sanitization: The skill lacks explicit sanitization or filtering logic for content retrieved from the repository before it is used to influence the generated code.
[SAFE]: The skill provides robust security guidance for the generated code, including requiring server-side identity checks, 'fail-closed' logic where access is denied by default, and a 'booleans-only' rule for configuration panels to prevent the accidental exposure of secret values.

scratchpad