The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is designed to execute a wide variety of standard development tools and test runners (e.g., git, npm, pytest, cargo, go test, mvn, gradle, npx) to perform code implementation and verification. These operations are restricted to the local repository and follow narrow scoping rules to avoid broad system impact.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Markdown files (user stories, tasks, work items, and test cases) to guide the agent's implementation steps. This represents a potential attack surface if project files contain malicious instructions.
Ingestion points: Reads specification files from the project repository, specifically under <changesPath>/user-stories/ and <changesPath>/work-items/ (e.g., TK-XXX.md, WI-XXX.md).
Boundary markers: The skill relies on directory structure and file naming conventions to identify data but does not use explicit boundary delimiters between system instructions and file content.
Capability inventory: The agent has the capability to write to the local filesystem, perform Git operations (commits, merges, worktrees), and execute arbitrary code via the project's test runners.
Sanitization: The skill includes explicit security guidelines to avoid printing or logging values from .env files and requires sanitizing evidence (removing tokens/cookies) before saving it to the repository.

work-implement