The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill drafts project documentation, such as CODING_STANDARDS.md, by analyzing repository history including merged pull requests, review comments, and commit messages. This ingestion of data from external code hosts creates a surface where an attacker could influence the agent's future instructions by leaving specific comments in the history.
Ingestion points: Pull request history, review comments, and commit messages feteched via API or CLI (specifically in references/project-docs.md).
Boundary markers: The instructions lack specific delimiters or technical boundary markers to isolate the historical data from the generation prompt, though it does instruct the agent to treat the text as data rather than instructions.
Capability inventory: The skill possesses the ability to execute shell commands (bash), run Python scripts, write files to the local repository, and initiate pull requests via downstream tools like ce-commit-push-pr.
Sanitization: The documentation drafting process relies on the LLM's own context management to distinguish between evidence and instructions without technical sanitization filters.
[COMMAND_EXECUTION]: The skill executes several bundled shell and Python scripts (scripts/check-health, scripts/config-refresh.py, scripts/packs-resolve.py) to perform environment diagnostics and manage project configuration. These scripts are invoked with the bash and python3 tools and interact with the local filesystem and external utilities like git and brew.
[EXTERNAL_DOWNLOADS]: The skill fetches external content to manage project dependencies and warm the local cache. It uses git clone to resolve 'Compound Packs' from remote repositories defined in user-controlled configuration files and uses npx to download Agent Client Protocol (acpx) packages. These operations target well-known services and public registries.

ce-setup