The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a utility script scripts/docy and integration tests (scripts/tests/test_docy_integration.py) that use subprocess.run to execute the local Python script for validation. This is standard testing behavior and does not pose a security risk as it only executes the skill's own distributed code.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to manage agent instructions, which presents a potential attack surface if the source data were untrusted. However, the skill restricts its operations to its own internal reference files.
Ingestion points: Markdown files located in the ./references/ directory (e.g., references/core/main.md).
Boundary markers: The skill uses HTML comment blocks () to delineate managed rule blocks within AGENTS.md files.
Capability inventory: The scripts/docy script performs file system reads from the internal reference directory and writes to local AGENTS.md files.
Sanitization: The script implements validation using pathlib.Path.relative_to and a whitelist-based discovery mechanism to ensure only legitimate reference files within the skill's scope can be accessed, preventing path traversal.

docy