The Agent Skills Directory

[DYNAMIC_EXECUTION]: The Python scripts scripts/record.py and scripts/open_items.py use the importlib.util module to dynamically load the ticket_records.py script from the local file system. This allows the skill to execute code from computed paths at runtime.
[COMMAND_EXECUTION]: The script scripts/baseline_state.py utilizes subprocess.run() to execute shell commands. It specifically invokes the git binary to perform repository operations such as rev-parse, diff, and ls-files. It also executes binaries like node, npm, and php with the --version flag to gather environment metadata.
[PERSISTENCE]: The script scripts/global_policy.py is designed to modify the agent's global environment by writing configuration blocks to CLAUDE.md and AGENTS.md in the user's configuration directories (e.g., ~/.claude/ or ~/.codex/). This is a persistence mechanism that ensures the skill's artifact policies are loaded across different sessions and projects.
[EXTERNAL_DOWNLOADS]: The documentation in OPTIONAL-HELPERS.md and SPECIALISTS.md references external code and tools hosted on GitHub repositories. Specifically, it points to github.com/anthropics/skills. These references are to a well-known and trusted organization and are intended for optional integration with specialized engineering tools.
[INDIRECT_PROMPT_INJECTION]: The skill presents a significant surface for indirect prompt injection because its core functionality involves reading, analyzing, and acting upon untrusted data from a repository (source code and markdown-based task records).
Ingestion points: Files in the repository, including project source code and task files like PLAN.md and TODO.md.
Boundary markers: The skill uses procedural phases to structure the agent's behavior, but lacks explicit sanitization or rigid delimiters for external data.
Capability inventory: The agent has the capability to write to the file system (task records, artifacts) and execute shell commands (git, and potentially any command approved during the 'execute' phase).
Sanitization: There is no evidence of specific escaping or sanitization of repository content before it is processed by the agent's logic.

workflow