The Agent Skills Directory

[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands through the 'Working gate' (Step 4), which instructs the agent to run 'every applicable project-wide verification command'. This allows the project environment to define what code the agent executes.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it is designed to ingest and strictly follow instructions from multiple repository files.
Ingestion points: The agent is instructed to read and obey content from .claude/rules/ (Step 2), meta/workflows/automated-testing/automated-testing-instructions.md (Step 4), and meta/workflows/execution/execution-instructions.md (Step 7).
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore potentially malicious embedded instructions within these external files.
Capability inventory: The skill possesses capabilities to write files, perform Git mutations (commits), spawn subagents, and execute shell commands.
Sanitization: There is no mention of sanitizing or validating the content retrieved from these repository-based instruction files before they influence the agent's logic or command execution.
[DYNAMIC_EXECUTION]: The protocol in Step 4 involves dynamically selecting and running verification levels (Focused, Subsystem, Full) based on the current state of the project, which results in the execution of project-defined test harnesses and scripts.

execute-chat