The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install @osovv/grace-cli globally using bun add -g. This package is a vendor-owned resource belonging to the author 'osovv'.
[COMMAND_EXECUTION]: The skill invokes the grace binary with various subcommands (lint, status, module, etc.) to perform project analysis and navigation.
[DYNAMIC_EXECUTION]: The --run-commands flag used with grace lint enables the execution of MustPassCommand values defined within project baselines or assertions. This allows the tool to run arbitrary shell commands specified in external project configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect injection via malicious project configuration.
Ingestion points: Untrusted project files (specified by --path PROJECT) containing assertions and baselines are read by the grace tool in SKILL.md.
Boundary markers: None present; the skill does not instruct the agent to verify the content of the commands before execution.
Capability inventory: The skill has the capability to execute shell commands via the --run-commands flag in SKILL.md.
Sanitization: There is no evidence of sanitization or validation of the MustPassCommand values before they are executed by the CLI.

grace-cli