The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads an embedding model from registry.ollama.ai. This is a well-known technology service. The download process includes an integrity check that verifies the file's SHA-256 hash against a pinned constant (06507c7b42688469c4e7298b0a1e16deff06caf291cf0a5b278c308249c3e439) before installation.
[COMMAND_EXECUTION]: The agent is instructed to execute local Python scripts using uv run to facilitate search and retrieval of Laravel patterns. Additionally, the maintenance script scripts/validate.py uses subprocess.run to call external PHP tools like rector and ecs. These calls use list-based arguments and do not invoke a shell, following security best practices for process execution.
[INDIRECT_PROMPT_INJECTION]: The search system ingests project-specific context provided in a JSON format (task.json) to find relevant patterns. While this creates a surface for indirect prompt injection, the risk is mitigated by strict path validation in scripts/reference_session.py (preventing directory traversal) and the fact that the ingested data is used primarily for ranking within a local, static index.
[DYNAMIC_EXECUTION]: The embedding runtime (scripts/embedding_runtime.py) utilizes ctypes to interface with the native llama-cpp library. This is a standard requirement for CPU-based model inference and is used here in a controlled manner with local bindings to the specific library.

laravel-project-patterns