The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs administrative tasks by executing chmod +x on the skillsw script during the installation process to enable its use as a project-level utility.
[REMOTE_CODE_EXECUTION]: The skill and its included skillsw utility invoke npx skills@latest, which fetches and executes code from the npm registry at runtime. Additionally, the skillsw script clones external skill repositories from GitHub using git clone based on definitions in the skills-lock.json file.
[DYNAMIC_EXECUTION]: The skillsw script uses node -e to execute inline JavaScript for JSON processing and skill management logic. Similarly, the enforce-subagent-model.sh adapter uses python3 -c to dynamically parse JSON input from the Cursor agent hook.
[PROMPT_INJECTION]: The skill includes instructions in assets/templates/prototype/AGENTS.md that command the agent to "Implement my requested prototype changes without asking again," which represents an attempt to override standard interaction safety protocols by suppressing user confirmation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and acting upon external data from skills-lock.json, which controls high-privilege operations such as remote code downloads.
Ingestion points: The skillsw script reads and parses the project's skills-lock.json file.
Boundary markers: There are no explicit boundary markers or "ignore instructions" warnings applied to the content of the lockfile before it is used to parameterize shell commands.
Capability inventory: The skill can write to project configuration files (e.g., CLAUDE.local.md, .cursor/hooks.json), execute shell commands (chmod, npx, git), and modify file permissions.
Sanitization: The script relies on node's JSON.parse but does not perform secondary validation of the source URLs or skill names before passing them to the npx skills add command.

setup-rules