The Agent Skills Directory

[DYNAMIC_EXECUTION]: The helper script scripts/agentctl-setup.js dynamically imports local library files (policy.js, proposal.js) using computed paths. This is a standard Node.js pattern for modularity within the repository and is used to load the mod's core logic.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'agentctl' plugin from the author's marketplace (agentctl@sd0xdev-marketplace) using the platform's native plugin manager. The resource is associated with the skill's author.
[COMMAND_EXECUTION]: The skill executes shell commands to perform environment checks (e.g., claude --version, git --version), list installed plugins, and manage the installation and uninstallation of the mod. It also offers to write security-enhancing 'deny' rules to platform settings files after explicit user approval.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied instructions to define the scope of agent tasks. It implements robust security controls to mitigate injection risks:
Ingestion points: User input for task goals, edit directories, and test commands are captured via AskUserQuestion in SKILL.md and references/workflow-integration.md.
Boundary markers: The skill avoids direct interpolation into shell commands, instead writing user input into a JSON-formatted temporary file (answers.json) with restricted permissions (0600) or passing it via stdin using a quoted heredoc.
Capability inventory: The skill uses file system operations (Write, renameSync, rmSync) and shell command execution (spawnSync) for configuration and installation.
Sanitization: The helper script includes a validation function (argvOf) that explicitly rejects any input containing shell metacharacters such as quotes, backticks, pipes, and redirects.

agentctl-setup