The Agent Skills Directory

[SAFE]: The skill provides security-hardened templates for creating lifecycle hooks. These templates implement input size limits using head -c, structural JSON validation via jq, and path traversal prevention using realpath and working directory checks.\n- [COMMAND_EXECUTION]: The skill's primary purpose is to configure shell scripts to execute upon specific agent events. It mandates defensive coding patterns, such as avoiding eval and checking for flag injection in filenames, ensuring that the execution of these scripts follows strict security guidelines.\n- [PROMPT_INJECTION]: Analysis of the indirect prompt injection surface (processing untrusted tool and user input) reveals strong mitigation strategies as per platform best practices:\n
Ingestion Points: Hooks receive tool inputs, outputs, and user prompts via JSON on stdin (SKILL.md).\n
Boundary Markers: Scripts use jq for structural JSON data and realpath for file system isolation.\n
Capability Inventory: Hooks can execute shell commands via the Bash tool (SKILL.md).\n
Sanitization: The skill provides logic for input size capping, JSON validation, path verification, and safe variable handling to sanitize external content.

hooks