The Agent Skills Directory

[OBFUSCATION]: The skill implements logic in scripts/runtime/adapters.mjs to generate Base64-encoded PowerShell commands (UTF-16LE) for cross-platform lifecycle hooks, which hides command intent from simple string analysis.
[DYNAMIC_EXECUTION]: The skill programmatically modifies the configuration of host agents (such as Codex, Claude Code, and Cursor) to inject lifecycle hooks that execute the skill's runtime scripts at project events like compaction and session starts.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted telemetry and event data from host agents to generate summarized context ('Work-Item Capsules') for the agent.
Ingestion points: stdin is read via io.readStdin() in several commands within scripts/runtime/cli.mjs, including hook, statusline, and telemetry.
Boundary markers: The skill uses Markdown headers (e.g., ## Objective, ## Reconciled capsule) to structure data before injection.
Capability inventory: The runtime uses node:child_process.spawnSync to execute git and node, and performs file system operations (read, write, delete) using node:fs.
Sanitization: The redactSensitive function in scripts/runtime/core.mjs uses regular expressions to identify and remove API keys, tokens, and private keys from output and stored state.
[COMMAND_EXECUTION]: The skill invokes system commands such as git for repository metadata and node for its internal CLI operations. It also configures host environments to execute shell-based hooks.

setup-universal-agent-skills