The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Node.js script (scripts/plan-workflow.mjs) to render a pre-run menu and validate workflow plans. This process is deterministic and read-only, ensuring that no unauthorized commands are executed during the planning phase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests repository configuration and user-provided selections, creating a potential surface for indirect injection. This is mitigated through:
Ingestion points: Workflow selections are ingested via user prompts or through the --selection flag in the planner script which reads JSON files.
Boundary markers: Explicit confirmation gates are defined for 'Repository writes', 'Dependency and runtime execution', and 'External publication'. The skill instructions specifically command the agent to check each boundary when it becomes actionable.
Capability inventory: All operations (e.g., upgrade, implementation, testing, release) are tracked in a phase ledger and delegated to specific owning skills with restricted scopes.
Sanitization: User input is strictly validated against the workflow-selection.schema.json schema to prevent malformed or malicious payloads from influencing the workflow state.

plugin-workflow