The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external specifications, requirements, and web content via BrowserOS. While the instructions explicitly state that external data should be treated as hostile and secrets should be redacted, this ingestion point creates a surface for indirect prompt injection if malicious instructions are embedded in the processed specifications.
Ingestion points: Specification files, requirements documents, and external data retrieved via BrowserOS.
Boundary markers: The skill relies on global protocols that warn to treat external data as hostile, though specific text delimiters for external content are not strictly enforced in the template.
Capability inventory: The skill possesses the ability to trigger subagents, write markdown artifacts to the file system (MemoryStore), and generate plans containing terminal commands (ExecutionProxy).
Sanitization: Instructions include a protocol to redact secrets and PII before sharing context with subagents.
[DYNAMIC_EXECUTION]: The skill generates implementation plans that include complete Python code blocks, Bash commands, and Git instructions. These are intended to be executed by other framework sub-skills. While these follow fixed templates for TDD, the generation of executable snippets from user-provided specifications constitutes a low-risk dynamic execution pattern.
[COMMAND_EXECUTION]: The skill templates include specific shell commands for execution (e.g., npm test, pytest, git commit). These are documented as part of the 'Iron Law of Execution' protocol and are mediated through an ExecutionProxy interface.
[DATA_EXPOSURE]: The skill instructions allow for the inspection of project metadata such as package.json for version pinning and internal architecture maps (docs/graph.json). This is standard functionality for a development-focused agent and does not involve unauthorized access to sensitive user credentials or keys.

writing-plans