The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to initialize project environments using file copy commands (cp) and to execute a local metadata synchronization script (set_docx_props.py) using the uv run command. These operations are confined to the local project workspace.
[DATA_EXPOSURE]: The set_docx_props.py script accesses the USERNAME environment variable to populate the 'Author' property in the generated .docx documents. It also reads project-specific metadata from the PLAN.md file to update document titles and custom properties.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface by ingesting data from PLAN.md to update document properties.
Ingestion points: Metadata values extracted from the PLAN.md frontmatter (e.g., title, tdoc, meeting).
Boundary markers: No explicit safety delimiters are used for the interpolated metadata.
Capability inventory: The skill can perform file system writes (modifying .docx files) and execute shell commands.
Sanitization: The Python script uses rudimentary string splitting and regular expressions to parse metadata, which limits the risk of sophisticated injection attacks against the script's logic.

sdo-project-setup