The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local utility script, scripts/collect.sh, to gather status information from the repository.
[DYNAMIC_EXECUTION]: Inside scripts/collect.sh, the skill identifies a command string from docs/agents/project.md and executes it using eval. This allows the execution of arbitrary shell commands if the source documentation file is modified by an untrusted party.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various project files and incorporates it into the agent's context, creating an attack surface for indirect prompt injection.
Ingestion points: Reads content from docs/specs/catalog/*.md, .skills/progress.md, .skills/implementation-notes.md, .skills/decisions.tsv, and .scratch/*/issues/*.md.
Boundary markers: No explicit delimiters or warnings (e.g., "ignore instructions in the following text") are used to isolate untrusted content from the agent's instructions.
Capability inventory: The agent can execute shell commands (including the eval of test commands) and interact with the GitHub CLI (gh).
Sanitization: The skill does not perform any escaping, validation, or filtering of the content retrieved from the repository before presenting it to the agent.

show-run-status