The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly forbids writing credentials into commands or plan documents (Rule WP-5). It instructs the agent to use placeholders like '' instead of actual values, preventing accidental exposure in the repository.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted external text (e.g., from issues or READMEs) via Rule WP-17. It requires the agent to quote such text into fenced blocks and rewrite requirements in its own words, preventing the agent from executing malicious instructions embedded in the input data. (1) Ingestion points: $ARGUMENTS in SKILL.md. (2) Boundary markers: tags and WP-17 mandatory fencing. (3) Capability inventory: Read, Grep, Glob, Write, Agent, Bash. (4) Sanitization: Rule WP-17 manual interpretation.
[COMMAND_EXECUTION]: While the skill allows the use of the Bash tool, it implements strict guidelines (Rule WP-9 and WP-10) limiting execution to read-only, repository-declared commands. It explicitly prohibits running commands that write, migrate, or access the network during the planning phase.
[EXTERNAL_DOWNLOADS]: The skill references a knowledge graph tool hosted on GitHub. This is documented as a recommended accelerant for the workflow and does not involve automated downloads or execution of untrusted remote code.

write-plan