The Agent Skills Directory

Standard Development Tool Execution: The skill's validation template in references/stage-dispatch.md includes the ability to run npm ci to prepare local environments for running checks. This is a standard practice for ensuring that validation occurs against the correct set of dependencies and is restricted to a conditional check for a valid lockfile.
Indirect Prompt Injection Surface: As a tool for creating and reviewing instructions, the skill processes potentially untrusted content. It includes specific defensive instructions to treat all fetched content as data, never as instructions, and to use structured parsing to mitigate the risk of the model following malicious directives embedded in the input.
Data Handling and Write Boundaries: The skill defines clear boundaries for file system operations and emphasizes the exclusion of secrets from artifacts. It uses a dedicated evidence root for logs and maintains a strict separation between advisory prose and enforced security controls.

hve-builder