The Agent Skills Directory

[COMMAND_EXECUTION]: Several components execute shell commands derived from project configuration files or input arguments.
loop_run.py executes arbitrary shell commands defined in the LOOP.md specification file under the verify, trigger, and skip_when fields.
dispatch_driver.py executes a user-supplied child-command to spawn sub-agents for coding and review tasks.
scripts/_common.py and other scripts extensively use subprocess.run to interact with the Git CLI and local environment.
[DATA_EXFILDTRATION]: The jev_review.py script performs network requests to an external service.
It sends criterion and evidence text to https://api.typesafe.ai/v1/systemone for optional evidence screening. While intended for its stated purpose and using environment-provided API keys, this involves sending repository-derived data to a non-whitelisted third-party domain.
[INDIRECT_PROMPT_INJECTION]: The skill maintains a large attack surface for indirect injection via project metadata.
It processes untrusted data from files like PLAN.md, INTENT.md, and LOOP.md (ingestion points in SKILL.md, workflow_run.py).
These files can contain shell commands that are subsequently executed by the orchestrator (capability inventory in loop_run.py and dispatch_driver.py).
There is no evidence of command sanitization or filtering for these configuration-defined commands.
[DYNAMIC_EXECUTION]: The skill uses dynamic loading and argument assembly at runtime.
path_config.py uses importlib.import_module to load sibling helper scripts.
model_policy.py dynamically assembles CLI argument arrays based on advertised host capabilities and project policies.

gsd-path-build