The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes lsel-apply.sh and verify.sh to apply git patches and run verification scripts.
Evidence: verify.sh executes a verify_command extracted from proposal metadata using eval.
Mitigation: The skill implements a timeout-retry-once policy and automatically performs a git revert if the verification command fails twice or times out. It also requires a mandatory independent /moai gate (lint/test/type-check) that the proposal cannot bypass.
[PROMPT_INJECTION]: As a mechanism for self-evolution, the skill is designed to process and apply external 'proposals' which are a form of indirect prompt injection surface.
Ingestion point: Reads decision.json, proposal.md, and diff.patch from the .moai/state/lsel/proposals/ directory.
Capability inventory: The skill can write to the local filesystem (via git apply), commit changes to the repository, and execute shell commands.
Boundary markers: Uses a frozen allowlist (.claude/lsel/frozen-allowlist.json) and specific synchronous-approval markers for sensitive 'execution-meta' targets to prevent unauthorized modifications to core logic.
Sanitization: Employs git apply for filesystem writes (hygiene) and validates all targets against the allowlist before execution.

hns-lsel-applier