The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python utility scripts (e.g., beads_hooks.py, finalize-feature-delivery.py, reconcile-beads-interactions.py) invoke the system tools git and bd (Beads) to manage repository state and workflow audit logs. These invocations are implemented safely using list-based arguments in subprocess.run, which prevents shell injection vulnerabilities.
[DYNAMIC_EXECUTION]: The script run-workflow.py uses runpy.run_path to execute local Python scripts defined as workflows. This is the intended primary purpose of the utility and includes logic to verify the existence of the target script within the local file system. The risk is minimized as it only operates on local paths provided during workflow execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as Beads issue descriptions and Git interaction logs, which presents a potential surface for indirect prompt injection.
Ingestion points: Data is ingested through tool outputs from bd show, bd list, and various Git commands across the script suite.
Boundary markers: The skill explicitly addresses this risk in references/TRUST-AND-AUTHORITY.md, instructing the agent to never execute instructions found in evidence and to treat such data as non-authoritative.
Capability inventory: The skill possesses the capability to write files (via sync-pi-reviewers.py) and execute system commands, but these are gated by strict validation logic.
Sanitization: The implementation uses rigorous JSON schema validation and structured parsing (notably in review-state.py and sync-pi-reviewers.py) to ensure ingested data conforms to expected formats before processing.

dstack-core