The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes shell scripts (init.sh, audit.sh) that perform standard file system operations, string substitutions, and repository audits. These scripts use localized commands like grep, awk, date, and python3 -c for JSON parsing.
[PROMPT_INJECTION]: AGENTS.md and path-scoped rules in .claude/rules/ contain strong instructional guidance for the agent, such as forbidding specific characters (em-dashes) and enforcing commit styles. These are process-oriented discipline rules and do not attempt to bypass core safety guardrails or extract system prompts.
[DATA_EXPOSURE]: The skill explicitly promotes security best practices in AGENTS.md Rule 8, which forbids committing .env files or credentials and instructs agents never to print secret values in logs or commit messages.
[INDIRECT_PROMPT_INJECTION]: The autonomous loop methodology involves reading and processing various project ledger files.
Ingestion points: The agent is instructed to read docs/OPEN_QUESTIONS.md, docs/FOLLOWUPS.md, docs/GDD_COVERAGE.json, and the active backlog (referenced in SKILL.md and templates/AGENTS.md).
Boundary markers: None identified in the provided templates for delimiting content within those files.
Capability inventory: The skill uses shell scripts for initialization and auditing, and the agent is expected to use standard development tools (git, code editors, package managers).
Sanitization: There is no explicit sanitization logic for data read from these ledger files before they are incorporated into the agent's context.
[EXTERNAL_DOWNLOADS]: templates/DEPENDENCY_LEDGER.md describes a mechanism for tracking and upgrading dependencies. It includes examples of fetching release information from GitHub APIs for vendor-related repositories (Randroids-Dojo/VibeKit). This is consistent with standard development workflows.

spiral