The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/gate_check.py script executes arbitrary shell commands using subprocess.run with shell=True. These commands are parsed directly from the CHECK: fields of markdown files located in the project's .outline/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill's operational model relies on ingesting and executing instructions from files in the workspace. This presents an attack surface where a malicious repository could include a pre-configured .outline/GATES.md file containing harmful commands.
Ingestion points: The script reads from .outline/GATES.md and any .md files within .outline/gates/ (referenced in scripts/gate_check.py).
Boundary markers: No delimiters or warnings are used to distinguish between user-intended and potentially malicious commands in the gate files.
Capability inventory: The skill has the capability to execute shell commands (subprocess.run) and write to the filesystem (updating the gate files with evidence).
Sanitization: The command strings are passed to the shell without any escaping, filtering, or validation.
[DYNAMIC_EXECUTION]: The script dynamically evaluates and executes command strings defined in document metadata at runtime, facilitating a workflow where executable logic is stored in plain-text markdown files.

unlazy