The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses Bash and Node.js subprocesses to perform setup tasks, file enumeration, and state management.
Evidence: SKILL.md contains several Bash scripts utilizing find, sed, grep, and node to manage the project environment and install hook assets.
[PERSISTENCE]: The skill establishes project-local persistence by installing Node.js scripts into the .claude/hooks/ directory and registering them in the platform's .claude/settings.json file to run automatically during sessions.
Evidence: The install and upgrade modes in SKILL.md copy docsync-track.mjs, docsync-watch.mjs, and docsync-gate.mjs to the local project and configure the agent to execute them on PostToolUse and Stop events.
[INDIRECT_PROMPT_INJECTION]: The skill's sync mode instructs the agent to follow a sync_procedure defined in the YAML frontmatter of project documents. This creates a surface where instructions embedded in untrusted documentation could influence agent behavior.
Ingestion points: Frontmatter is read from project .md files during status checks, tracking, and synchronization (SKILL.md, docsync-gate.mjs).
Boundary markers: The skill relies on standard YAML delimiters (---) but lacks explicit security boundaries for the prose instructions in the sync_procedure field.
Capability inventory: The agent possesses file-system access and command-execution capabilities used during the document synchronization process.
Sanitization: Content within the sync_procedure field is passed to the agent without specific sanitization or filtering.
[DYNAMIC_EXECUTION]: The skill dynamically generates and executes Node.js code at runtime to handle the installation and configuration of hooks.
Evidence: The installation logic in SKILL.md uses a heredoc pattern (`node
... <<'NODE'`) to execute a script that performs atomic file writes and merges JSON configuration files.

docsync-setup