The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/cockpit.py utilizes subprocess.Popen to launch local Python scripts and shell commands (mine.py, corrections.py, recheck.py, forge.sh) which comprise the agent's improvement toolkit.
[COMMAND_EXECUTION]: Safety controls are implemented to prevent command injection: numeric inputs like sessions and cluster_index are cast to integers, and the brief_id is validated against a strict alphanumeric regex ([A-Za-z0-9._-]+).
[COMMAND_EXECUTION]: Directory paths provided to the eval action are validated to ensure they reside within authorized 'drafts' or 'skills' directories using os.path.realpath to prevent path traversal attacks.
[SAFE]: The local HTTP server includes robust defenses for its environment, such as binding strictly to 127.0.0.1, verifying the Host header to mitigate DNS rebinding, and requiring a platform-generated secret token (X-Cockpit-Token) for all state-changing POST requests.

skill-cockpit