The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard command-line tools to manage project tasks and version control. Evidence: It uses git for branch creation and commits (references/10-git-workflow.md), uv for Python dependency management, and npm, yarn, or pnpm for Node.js environments (references/08-coding-standards.md). It also leverages the GitHub CLI (gh) for pull request operations (references/06-start-and-resume.md).
[EXTERNAL_DOWNLOADS]: The skill manages software dependencies by downloading external packages from official registries. Evidence: Instructions guide the agent to use package managers like uv, npm, or Maven to add third-party libraries (references/08-coding-standards.md), which involves fetching external code from remote servers.
[PROMPT_INJECTION]: The skill's core workflow exposes a surface for indirect prompt injection (Category 8). Ingestion points: The agent is directed to read existing source code and project documentation during its execution loop (references/00-agent-execution.md). Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded within the code or documentation being analyzed. Capability inventory: The agent has permission to read and write files, execute shell commands, and dynamically invoke other agent skills via the platform's Skill tool (references/06-start-and-resume.md). Sanitization: There are no explicit requirements for sanitizing or validating external content before it is processed as part of the agent's task instructions.

spec-coding-skill