The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several utility scripts (e.g., smoke_build.sh, run_unit_tests.sh, gradle_sync_check.sh) that execute Gradle commands to compile and test Android applications. This is standard developer functionality and is limited to building the target project.
[COMMAND_EXECUTION]: The scan_implementation.py script uses subprocess.run to call git show to compare code against a committed baseline for architectural validation in existing modules. The commands are constructed using discovered local file paths and executed without a shell, preventing injection risks.
[COMMAND_EXECUTION]: The runtime_launch_check.sh script utilizes adb (Android Debug Bridge) to install and launch applications on connected devices or emulators. This behavior is expected and necessary for the stated purpose of validating application deployment and runtime stability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted design data from Figma and screenshots. It effectively manages this risk through a mandatory 'Designer Gate' and 'Fidelity Checker' that translate design intent into a structured, validated JSON specification (design-spec.json) before any code is generated. This multi-step process with machine-driven verification ensures that generated code strictly adheres to approved design and safety patterns.

spatial-design-to-app