The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted data, such as customer tickets, retrieved documents, and tool outputs, which constitutes an indirect prompt injection surface.
Ingestion points: Untrusted data enters the agent context through the state field in multiple functions across AGENTS.md and QUESTIONS.md.
Boundary markers: The skill explicitly mitigates this risk by providing dedicated detection patterns (e.g., the injection check in QUESTIONS.md) and instructions to treat state as evidence, not instructions.
Capability inventory: The skill utilizes local command execution (execFileSync in AGENTS.md) and file writing (writeFileSync to REVIEW.md and .claude/.pushes) to manage its state and verify work.
Sanitization: External content is interpolated into structured JSON states rather than free-form prompts, reducing the risk of model manipulation.
[COMMAND_EXECUTION]: The skill includes functionality to execute local shell scripts (.claude/checks.sh via bash) to gather evidence and verify task completion. This is a standard and intended pattern for agentic work verification in development environments.
[DYNAMIC_EXECUTION]: The skill dynamically executes local verification scripts and performs file system operations (reading GOAL.md, writing REVIEW.md) at runtime to maintain persistent state across agent turns and evaluate results against defined goals.
[SAFE]: The skill implements significant safety-enhancing features, including a tool-gating hook (jev-gate.ts) that uses a blocklist for dangerous shell commands (e.g., rm -rf /, git push --force, curl -X POST) and requires model-based risk assessment or human review before allowing execution.

jev-decisions