The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local utility script, scripts/workflow_state_snapshot.sh, to gather environment metadata such as current directory, git branch, and changed files. This script performs read-only operations and is part of the skill's own package, presenting no privilege escalation or remote code execution risks.- [PROMPT_INJECTION]: The skill is designed to ingest and follow instructions found within AGENTS.md files in the target codebase. This is a functional requirement for its task-coordination purpose but establishes an indirect prompt injection surface.
Ingestion points: The agent is instructed in SKILL.md to load AGENTS.md files during startup, and the workflow_state_snapshot.sh script actively scans the directory hierarchy for these files.
Boundary markers: The skill does not define specific delimiters or instructions to treat repository-provided context as untrusted, instead treating it as authoritative project configuration.
Capability inventory: The skill possesses the capability to modify files, execute git commands, and run standard build/test tools such as cargo, npx, and pytest.
Sanitization: No sanitization or validation is applied to the content of AGENTS.md files before they are loaded into the agent's context.

flowguard