The Agent Skills Directory

[COMMAND_EXECUTION]: The skill configures several automated hooks (PreToolUse, PostToolUse) that execute Python scripts using uv run python3 for nearly every agent action. These include scripts like ds-post-subagent-guard.py and ds-no-main-chat-code-guard.py located in the plugin root.
[COMMAND_EXECUTION]: The skill executes a bash script check-all-ds.sh located at a relative path from CLAUDE_SKILL_DIR, passing the current working directory as a parameter.
[REMOTE_CODE_EXECUTION]: The skill uses a shell command to dynamically discover the latest version of a JavaScript workflow file (ds-validate-coverage.js) within the ~/.claude/plugins/cache/edwinhu-plugins/ directory. It then executes this script using the Workflow tool. Loading and executing code from paths computed at runtime is a significant security risk.
[PROMPT_INJECTION]: The skill ingests data from external and potentially untrusted files including SPEC.md, PLAN.md, and LEARNINGS.md. This data is used to drive the validation logic and populate the final VALIDATION.md report. This represents an indirect prompt injection surface as malicious instructions in these files could influence agent behavior during the validation process.
Ingestion points: .planning/SPEC.md, .planning/PLAN.md, .planning/LEARNINGS.md (read during Steps 1-3).
Boundary markers: None detected; content is extracted and processed directly.
Capability inventory: The skill can execute shell commands (bash, uv run), edit files, and run JavaScript workflows.
Sanitization: No evidence of sanitization or escaping of the ingested content before it is used in the workflow logic.

ds-validate