The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/setup_project.py executes local git commands via the subprocess module.
Evidence: The script uses subprocess.run(['git', '-C', str(root), *args], ...) in scripts/setup_project.py.
Analysis: Commands are executed by passing a list of arguments, which prevents shell injection. The sub-commands are restricted to rev-parse, ls-files, and check-ignore, all of which are read-only or configuration-checking operations.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external data that may contain malicious instructions.
Evidence: references/discovery-protocol.md contains an 'Untrusted-source hard boundary' section.
Analysis: The skill provides clear instructions to the agent to treat all retrieved material (webpages, issues, documents) as evidence only and specifically warns against executing embedded commands or allowing source content to override agent boundaries. This is a proactive security measure against indirect prompt injection.
[SAFE]: No malicious patterns such as obfuscation, data exfiltration, or credential theft were detected. The skill and its scripts operate locally without network access.

setup-idea-to-promise