The Agent Skills Directory

[PERSISTENCE]: The skill installs several persistent lifecycle hooks into the agent harness configuration (e.g., .claude/settings.json, .opencode/plugins/). These hooks (SessionStart, PreToolUse, PostToolUse, Stop) execute shell commands during session startup, tool usage, and session termination, ensuring the skill's rituals remain active across sessions.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to audit the environment and repository state. These include reading internal plugin metadata (cat ~/.claude/plugins/...), using the GitHub CLI to check for releases (gh release view), and running a local vendor script (node ~/.iskron-bridge/iskron-bridge.mjs).
[DYNAMIC_EXECUTION]: The skill dynamically generates and writes executable instruction files for sub-agents (e.g., .claude/agents/reader.md, worker.md, verifier.md, reviewer.md) and injects complex shell scripts into the harness's JSON configuration settings.
[DYNAMIC_CONTEXT_INJECTION]: Through its hook mechanism, the skill configures the harness to execute arbitrary shell commands (e.g., jq processing and conditional logic) at runtime in response to specific tool calls, which is a form of harness-integrated dynamic code injection.
[CREDENTIALS_UNSAFE]: The skill explicitly scans the local repository for sensitive files using patterns like .env*, *secret*, and *local*. While it advises the user on how to avoid committing these files, the automated detection of secrets by an agent tool is a sensitive operation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository (e.g., package.json, Makefile, CI workflows) and interpolates it directly into agent instructions and documentation (AGENTS.md) without robust boundary markers, creating a surface for malicious repository content to influence agent behavior.

iskronify