The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on a local bash script (scripts/new.sh) to scaffold new projects and utilizes shell commands for file system operations, such as moving, copying, and deleting files during project flattening and migration workflows.
[REMOTE_CODE_EXECUTION]: As part of the migrate workflow, the agent is instructed to execute the contents of user-provided Python notebooks in a clean kernel to analyze behavior, inputs, and side effects before moving logic into a package.
[INDIRECT_PROMPT_INJECTION]: The ingestion and execution of external Python notebooks during the migration workflow creates an attack surface where untrusted data could influence agent behavior.
Ingestion points: External .py notebook files provided as arguments to the /python-code-dev migrate command.
Boundary markers: The instructions suggest execution from a "clean kernel," but no explicit delimiters are defined for processing the notebook content.
Capability inventory: The skill has access to Bash, Write, and Edit tools, allowing it to execute uv run, python, and modify project files.
Sanitization: There is no explicit sanitization or filtering of notebook content before it is executed or refactored into the project structure.
[DYNAMIC_EXECUTION]: The scripts/new.sh scaffolding script uses a Python heredoc to dynamically execute a script that performs string substitution (replacing placeholders like __PACKAGE__) across the generated project files.

python-code-dev