The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from the repository being processed.
Ingestion points: The agent is instructed to read "touched files," "repo contract policy files" (such as change-contract-policy.sh), and other "contract artifacts" to determine its workflow.
Boundary markers: The instructions include advisory markers such as "Inspect a policy/documentation mismatch before deciding which artifact needs correction" and "Inspect commands before running them; executable policy files are code, not inert configuration."
Capability inventory: The skill has the capability to execute shell commands, specifically a "checker command" and "validation profiles" defined in the policy files.
Sanitization: There is no evidence of strict schema validation or sanitization for the ingested policy data before it is used to determine execution paths.
[COMMAND_EXECUTION]: The skill directs the agent to execute shell commands based on repository content.
The instructions in SKILL.md and references/operator-quickstart.md explicitly tell the agent to "Run the smallest validation profile that proves the change" and "Run the checker command."
The example script references/run-release-checklist.example.sh provides a scaffold that executes several local repository scripts, including scripts/check-release-hygiene.sh and scripts/check-change-contracts.sh, as well as build tools like cmake and ctest.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic discovery to determine which code to execute at runtime.
It searches for policy files and artifacts to define the "default validation commands" and "lane names."
This pattern of dynamic loading from paths and commands computed from the target repository's files represents a runtime execution surface controlled by the repository's content.

development-contract-process