The Agent Skills Directory

[SAFE]: The skill implements strong integrity controls for its input data. It requires the agent to execute a bundled validation script (scripts/finalize_opgen_inputs.py) that verifies SHA-256 hashes of all input specifications and evidence files. This ensures that the agent only processes authorized and untampered data.
[SAFE]: The validation script is designed with security best practices, utilizing strict JSON parsing that rejects duplicate keys and non-standard constants (such as NaN or Infinity). It also validates that all file paths are resolved correctly within the authorized workspace, preventing path traversal risks.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured data from previous stages to generate implementation code. This inherent attack surface is mitigated to a safe level through mandatory programmatic validation.
Ingestion points: Handoff manifest (opgen-inputs.json) and associated operator specifications.
Boundary markers: Integrity is maintained through cryptographic hashes and schema validation rather than natural language delimiters.
Capability inventory: Source code generation, project file modification, and delegation to verified child skills (pva-build-test, pva-debug).
Sanitization: Automated verification of file types, sizes, and content hashes before data is used in the workflow.

pva-opgen