The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the AI agent to execute shell commands using the npx skills CLI to remove itself after a successful setup. This is a functional requirement of the 'bootstrap' design to ensure the setup skill does not persist in the agent's environment once its task is finished.
[INDIRECT_PROMPT_INJECTION]: The skill operates as a template engine that ingests external data from the target AGENTS.md file and snippets from other installed skills (e.g., $project-memory).
Ingestion points: Target AGENTS.md and assets/snippets/project-memory-methodology.md from the $project-memory skill directory.
Boundary markers: The skill relies on explicit agent instructions to 'propose an intelligent merge' and 'show before writing' rather than strict token delimiters.
Capability inventory: The skill possesses file-write capabilities (to AGENTS.md) and shell execution capabilities (npx skills remove).
Sanitization: The workflow enforces a mandatory human-in-the-loop 'review-first diff' and post-write validation to prevent accidental or malicious instruction processing.
[DATA_EXPOSURE]: To resolve the correct installation scope, the skill reads project metadata including skills-lock.json and the .agents/skills/ directory. This is consistent with its primary purpose of configuring the environment and does not involve sensitive user credentials.

setup-gcubed-skills