The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/check-before-merge.sh facilitates the execution of shell commands provided as arguments via sh -c. This is used during the merging process to run recipe-defined checks.
[EXTERNAL_DOWNLOADS]: The references/trim.md file recommends using npx or pipx run to dynamically fetch and execute various static analysis tools (knip, vulture, deptry, jscpd, lizard) from public registries.
[COMMAND_EXECUTION]: The skill makes extensive use of git and the GitHub CLI (gh) to manage branches, push code, perform API requests, and merge pull requests. It includes logic to prevent accidental uploads to the source repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the codebase (such as the 'masterplan' and 'piece' descriptions) which can influence sensitive operations:
Ingestion points: Loads instructions and constraints from SKILL.md, masterplan, and code comments (Under the hood).
Boundary markers: Relies on markdown headers and plain-line notes; lacks formal sanitization or strict delimiters for code-integrated feedback.
Capability inventory: Performs file system modifications, Git pushes, and arbitrary shell command execution through the check-before-merge.sh utility.
Sanitization: Lacks explicit shell-escaping or structural validation for data extracted from files and interpolated into command strings.

section-builder