The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automatically extracts and executes commands from repository configuration files, such as package.json, Makefile, justfile, and GitHub Actions workflows (.github/workflows/*.yml). The detection logic in scripts/detect-gates.mjs uses keyword-based filters (CI_SIGNAL and CI_NOISE) which could potentially be bypassed by malicious repositories embedding arbitrary commands within seemingly benign script blocks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project plans, issue descriptions, and repository diffs to generate verification matrices and behavior proof procedures. There is a risk that malicious instructions embedded in these sources could influence the commands executed during the 'Behavior Proof' lane (Lane D) or the 'Fix' loop (Phase 5).
Ingestion points: Plan text from ~/.claude/plans/, project files, and git diffs.
Boundary markers: Prompts use structured sections but lack explicit instructions to disregard embedded commands in the source text.
Capability inventory: The skill has the ability to execute shell commands via sub-agents and write to the file system during the fix phase.
Sanitization: There is no explicit sanitization of input text before it is used to formulate proof procedures.
[SAFE]: The skill includes a deterministic guard (scripts/forbidden-repairs.mjs) specifically designed to prevent the AI from 'cheating' during the fix loop by adding suppressions (e.g., @ts-ignore), skipping tests, or tampering with CI configurations. This is an excellent safety practice that preserves the integrity of the verification process.

verify