The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/_skill_cli.py includes a run_command function wrapping subprocess.run. The implementation follows security best practices by disabling shell interpolation (shell=False) and resolving executable names to absolute paths via shutil.which to prevent path hijacking or injection.
[INDIRECT_PROMPT_INJECTION]: The validate_composable.py script presents a standard injection surface by ingesting and analyzing user-provided source code files.
Ingestion points: The script reads file content via target.read_text() based on user-supplied paths.
Boundary markers: None are present in the processing logic.
Capability inventory: The tool is restricted to read-only file access and local script execution as defined in the manifest.json tool definition.
Sanitization: The script uses regex for static analysis and does not execute, evaluate, or pass the ingested content to an LLM, mitigating the risk of instructions being followed.
[SAFE]: The skill documentation and metadata focus on stylistic constraints and design patterns. The 'Prose Anti-slop' guidelines are benign behavior steering mechanisms for the AI agent.

composable-patterns