The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses dynamic loading and runtime redirection techniques.
The scripts/path_config.py file uses importlib.import_module to load siblings dynamically based on computed names.
As described in references/runtime-selection.md and implemented in scripts/workflow_run.py, the skill can be redirected to use a 'project runtime' defined in the target repository. If a .gsd-path/runtime.json file is present, the skill executes a repository-provided status_runtime.py to locate helper scripts, effectively allowing the repository content to take control of the agent's helper execution.
[REMOTE_CODE_EXECUTION]: The skill is designed to execute code provided by the repository it is operating on.
It executes project-provided Python scripts during the runtime selection and workflow orchestration phases.
In scripts/loop_run.py, the run_shell function executes arbitrary shell commands directly from the LOOP.md specification file found in the repository.
[COMMAND_EXECUTION]: The skill's core functionality involves the execution of shell commands defined in user-controlled files.
scripts/loop_run.py executes commands from a spec file using subprocess.Popen via the run_shell function.
The templates/plan.md and templates/task.md instruction files tell the agent to execute Project verify and Verify commands found in the generated plan and task artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill processes a large variety of untrusted data from the managed repository, creating a significant injection surface.
Ingestion points: Data enters the agent context from project-controlled files including INTENT.md, PLAN.md, ROADMAP.md, LOOP.md, and task files at .project/tasks/.
Boundary markers: The system uses Markdown headings and YAML frontmatter as delimiters, but there is a lack of explicit 'ignore embedded instructions' warnings for several of the ingested file types.
Capability inventory: The skill has broad capabilities, including arbitrary shell command execution (scripts/loop_run.py), filesystem manipulation (scripts/_common.py), and interaction with the GitHub API via the gh CLI (scripts/integration.py).
Sanitization: While the Python scripts perform structural validation (e.g., checking for required YAML fields or contiguous IDs), there is no evidence that the natural language content or commands from these files are sanitized or escaped before being processed by the AI or executed.

gsd-path-plan