The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes project-level artifacts such as PRDs and task files which may contain malicious instructions if the local repository or workflow directory is compromised.\n
Ingestion points: Loads data from .ai-workflow/work/<feature-slug>/, including tasks-draft.md, PRDs, and individual task specifications.\n
Boundary markers: Employs strict worker isolation using fresh subagent or runner contexts for every task. It mandates an explicit human approval gate for the 'Model Plan' that cannot be bypassed by default settings or silence.\n
Capability inventory: Possesses capabilities to perform file writes (reports and state files), Git operations (commit, push, PR), and execution of arbitrary shell commands defined in task artifacts.\n
Sanitization: Relies on the user to review a concrete preview of the implementation/review models and acceptance criteria before dispatching any work.\n- [COMMAND_EXECUTION]: The skill orchestrates the execution of shell commands defined within task files as 'acceptance' criteria.\n
Evidence: The workflow passes <exact commands and observable behaviors from the task> to subagents and integrates changes into the working tree or worktrees, followed by combined state verification.\n- [DYNAMIC_EXECUTION]: The skill dynamically resolves and invokes external skill launchers and 'runners' at runtime based on the approved model plan.\n
Evidence: It loads the implement-and-review skill launcher and passes configuration, such as routing plans and task tracks, via command-line arguments to sub-processes.

implement-tasks