The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a claudeCode harness to execute local scripts and CLI tools. Specifically, it runs scripts/collect/day.ts to gather git history and gh (GitHub CLI) data. It also uses the cargo-ai CLI to read workspace metrics such as run counts and usage. These operations are limited to read-only actions through strict system prompt instructions and environment isolation.
[INDIRECT_PROMPT_INJECTION]: The agent processes untrusted external content, including git commit messages and pull request titles. This creates a surface for indirect prompt injection. However, the skill mitigates this by using a deterministic collection script (reducing LLM improvisation) and providing specific structural and 'voice' constraints in the system prompt to ensure the agent maintains its reporting role.
Ingestion points: scripts/collect/day.ts (git/gh data), cargo-ai CLI calls.
Boundary markers: Present in standup.prompt.ts via structured sections and 'Voice' rules.
Capability inventory: claudeCode harness has tool access (slack.postMessage) and shell access; the agent spec itself includes no additional capabilities.
Sanitization: Mitigated by strict output formatting rules and the use of markdown templates.
[EXTERNAL_DOWNLOADS]: The skill references and installs the @cargo-ai/cli package via npx. As this package belongs to the skill's authoring organization and is a standard component of the platform's infrastructure, it is considered a safe dependency.
[DATA_EXFILTRATION]: The skill is designed to post digests to Slack. To prevent unauthorized data exposure, the channelId is hard-locked in the connector configuration, ensuring the agent cannot redirect internal project data to external or customer-facing channels.

standup