The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly instructs the agent to suggest executing the command npx skills add wondelai/skills/<slug> --global to the user when a required sub-skill is missing. This facilitates the execution of shell commands to modify the user's environment.
[EXTERNAL_DOWNLOADS]: The instructions direct the agent to fetch and install external skills from the 'wondelai' repository, which is an unverified third-party source not associated with the skill author.
[REMOTE_CODE_EXECUTION]: Recommending the global installation and execution of code from a remote third-party source introduces a significant risk of remote code execution, as the installed sub-skills may contain arbitrary logic.
[COMMAND_EXECUTION]: The intake process mentions using git log to assess code churn, which implies the ability to execute shell commands within the local repository context.
[PROMPT_INJECTION]: The skill is designed to read and resume state from files in the docs/ directory, such as IMPROVE-CODE-QUALITY-PLAN.md. This represents an indirect prompt injection surface where malicious content in these files could influence the agent's logic in future sessions.
Ingestion points: docs/IMPROVE-CODE-QUALITY-PLAN.md, docs/TESTING.md, docs/TECH-DEBT.md, docs/RELIABILITY.md, docs/ARCHITECTURE.md (all read in Operating Rule 1).
Boundary markers: None present; the agent is instructed to read these files as ground truth for resuming the journey.
Capability inventory: Suggesting shell command execution (npx), writing to the local filesystem (docs/ directory).
Sanitization: None detected; the agent reads and extends these markdown files directly.

improve-code-quality