The Agent Skills Directory

[SAFE]: The skill enforces strong local security controls, specifically requiring restrictive file permissions (0700 for directories and 0600 for files) and utilizing atomic compare-and-swap operations for manifest updates to ensure data integrity.
[SAFE]: The instructions explicitly forbid the agent from making any remote provider calls or network requests, ensuring that the ideation process remains entirely within the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted data from the repository to facilitate brainstorming, though it incorporates substantial mitigations.
Ingestion points: The agent is instructed to inspect the repository context to identify questions and gather evidence for the specification (SKILL.md).
Boundary markers: The skill defines a "Non-negotiable content invariant" that explicitly forbids the persistence of any inferred, agent-preferred, or repository-derived content until the user verifies it.
Capability inventory: The skill has the capability to perform atomic file writes to a local JSON manifest (SKILL.md). It does not have access to shell execution or network tools.
Sanitization: The skill relies on mandatory, explicit user verification for every decision, behavior, and constraint. It explicitly states that "Silence, a plausible answer, or an agent-authored summary is not verification," which provides a high degree of protection against obeying instructions hidden in repository files.

woostack-ideate