The Agent Skills Directory

[SAFE]: The skill is focused on document workflow and structural validation. Analysis of the provided scripts and instructions shows no high-risk behaviors or malicious patterns.
[COMMAND_EXECUTION]: The skill utilizes local Python scripts (check_work_item.py, inspect_work_item.py, promise_identity.py) to perform structural and integrity checks on project files. These scripts are designed for internal validation, are read-only, and do not perform network operations or execute arbitrary system commands.
[INDIRECT_PROMPT_INJECTION]: The skill implements strong defensive measures against indirect prompt injection. The discovery-protocol.md file contains a dedicated 'Untrusted-source hard boundary' section instructing the agent to treat all retrieved material as evidence only and never as execution authority, explicitly forbidding the execution of embedded commands found in external sources.
[DATA_EXPOSURE]: The included Python scripts contain robust security checks to prevent path traversal attacks. Functions such as local() and inside() use path.resolve() and is_relative_to(root) to ensure that all file operations are strictly confined within the designated project root directory.

shape-promise