The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes multiple project artifacts and runbooks, which can contain instructions that influence the agent's behavior. This creates a surface for indirect prompt injection.
Ingestion points: Project artifacts located in docs/specs/, docs/plans/, and docs/spikes/, as well as output from the scripts/runbooks/select-runbooks.sh script.
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore embedded instructions within these processed files.
Capability inventory: The skill includes capabilities to perform git commits (via he-bootstrap), modify files (via he-implement), and manage pull requests (via he-github).
Sanitization: No sanitization or validation of the content read from these external files is mentioned.
[COMMAND_EXECUTION]: The skill executes local shell scripts and orchestrates several sub-skills to manage the development lifecycle.
Evidence: bash scripts/runbooks/select-runbooks.sh --skill he-workflow and references to executing he-bootstrap, he-implement, and he-github skills.
Context: While these executions are necessary for the workflow's operation, they involve running code from the repository that could be influenced by external project data.

he-workflow