The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs legitimate local shell operations to manage project state.\n
Evidence: In SKILL.md, it describes a setup step using grep, printf, and git commit to ensure the .skills/ directory is ignored by version control.\n
Evidence: It utilizes standard git commands to generate logs and diffs for review purposes.\n- [DATA_EXFILTRATION]: All data handling is restricted to the local file system with no network activity.\n
Evidence: Task-related artifacts are stored in a local .skills/ directory.\n
Evidence: The skill does not access sensitive system locations or credentials, focusing exclusively on project-specific files like tasks.md.\n- [PROMPT_INJECTION]: The skill manages potential indirect injection risks through architectural design and human oversight.\n
Ingestion points: The skill ingests untrusted data from tasks.md and requirements.md to generate implementation briefs.\n
Boundary markers: It uses verbatim 'Global Constraints' as context, though explicit delimiters for user-supplied story content are not specified.\n
Capability inventory: The skill can execute local shell commands (git, grep), write to the file system, and dispatch subagents.\n
Sanitization: No explicit sanitization or filtering of external content is performed.\n
Mitigation: A strict 'Iron Law' mandates a human review and 'unlock' after every task unit, preventing the agent from autonomously following malicious instructions embedded in the processed data.

execute-story