The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y godpowers@7 to download and execute code from an external package on the public npm registry at runtime.
[COMMAND_EXECUTION]: The skill executes multiple shell commands, including git diff with a user-supplied base reference and a <verify command> passed to the godpowers utility. The verify command is sourced from project documentation which may contain untrusted input.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external files like PLAN.md, STATE.md, and DECISIONS.md without explicit boundary markers or sanitization.
Ingestion points: Reads requirements and verify commands from PLAN.md and STATE.md (Step 2 and 4).
Boundary markers: None identified in the instructions for separating untrusted file content from agent instructions.
Capability inventory: Includes execution of shell commands, git operations, and software package installation/execution.
Sanitization: The skill does not implement validation or escaping for the <verify command> or the diff <base> argument before passing them to the shell.

god-review