The Agent Skills Directory

[SAFE]: The skill defines a defensive state machine for engineering workflows. It explicitly forbids autonomous mutations and requires human authorization for critical actions such as admitting new work or promoting code to external systems (PRs, merges).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as feature requests, issues, and pull requests, which creates a potential surface for indirect injection. However, this is heavily mitigated by the skill's architecture.
Ingestion points: SKILL.md (Section 2) accepts issues, pull requests, and manual requests via the work-intake skill.
Boundary markers: The skill instructs the agent to preserve pinned source identities and enforce "forbidden actions" defined during intake.
Capability inventory: The loop orchestrates tools for file system interaction (via software-factory) and external communication/code promotion (via ship).
Sanitization: Security is enforced through mandatory human gates. The skill stops execution for "explicit human confirmation" before admission and again for "explicit human authority" before any external promotion or commit action.

factory-loop