The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines a wrapper for subprocess.run in tools/stdio_utf8.py and provides instructions for the agent to run internal state-management tools such as init_docket.py, validate_docket.py, and emit_tracker.py. The case_id input, which is passed to these scripts, is validated against a strict regex ^[a-zA-Z0-9][a-zA-Z0-9._-]{0,80}$ in tools/docket_paths.py, which prevents command injection via the project name.
[INDIRECT_PROMPT_INJECTION]: The skill processes external information from user-provided materials and issue lists (问题清单.md) generated by other tools.
Ingestion points: Materials are ingested in prompts/bootstrap.md, and issue lists are read in prompts/triage.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when interpolating external content into the coordination prompts.
Capability inventory: The skill can perform file system writes and execute local Python scripts defined within the package.
Sanitization: While specific fields like case_id are sanitized, the primary mitigation against indirect injection is a hard-coded iteration limit of 3 rounds (defined in config.yaml) and explicit instructions in prompts/guardrails.md that forbid the agent from fabricating technical facts or bypassing safety intake procedures.

patent-docket