The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the dynamic context syntax (!command) to execute shell logic at skill load time. This command attempts to locate and execute the skill-toc utility from the plugin-utils directory to generate a table of contents for the skill's references. This is a legitimate documentation-helper pattern.
[COMMAND_EXECUTION]: The skill is designed to run arbitrary project-level commands for testing, linting, and building through scripts/check.sh. These commands are supplied as arguments during the workflow interaction, which is necessary for the skill's primary function of executing a project's own test suite.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of project source code and test outputs. It uses an 'Explore' agent to judge these artifacts against security and performance lenses. This creates an attack surface where malicious code in the project being developed could attempt to influence the agent's judgment, although the skill includes extensive instructions for objective verification and manual oversight.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to install external developer tools, including Language Servers (LSPs) and browser automation frameworks like Playwright, using standard package managers (npm, claude plugin install). These are routine setup steps for a development environment.

dev