The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool extensively for administrative tasks. This includes resolving the plugin root directory, verifying the presence of asset files, copying hook scripts to the target directories, and executing Node.js processes to safely manipulate JSON configuration files.
[DYNAMIC_EXECUTION]: The skill employs node -e blocks within Bash commands to perform complex JSON merging and validation on settings.json and agent-return.json. This method is used to ensure structural integrity of the configuration files without relying on brittle text-based editing. The code for these operations is statically defined within the skill's instructions and assets.
[INDIRECT_PROMPT_INJECTION]: The agent-return-guard.mjs hook constitutes an indirect prompt injection surface because it modifies the agent's context based on the content of subagent returns.
Ingestion points: The hook ingests the last_assistant_message of a subagent through standard input during the SubagentStop event.
Boundary markers: The injected feedback reason is clearly delimited with the disclaimer "Directive from the agent-return guard, not user data." to prevent the agent from misinterpreting the system feedback as a new user instruction.
Capability inventory: The hook is limited to returning a decision object (pass or block). It does not perform autonomous network requests or unrestricted file system writes (reports are directed to a predefined directory).
Sanitization: The feedback is formatted as a structured JSON response using standard library functions, minimizing the risk of schema confusion.
[PERSISTENCE]: The skill establishes persistence for its budget enforcement logic by registering command-based hooks in the user's global or project-specific settings.json files. These hooks are designed to trigger automatically on every SubagentStart and SubagentStop event.

agent-return-setup