The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/workflow.md contains a hyperlink to https://product.md/. Automated scanners (URLite) have identified this domain as blacklisted/malicious. In the context of the instructions, this appears to be a misconfigured local file reference that instead points to a suspicious external site.
[COMMAND_EXECUTION]: The skill instructions (notably in references/gates.md) frequently direct the agent to execute a project-local script located at .hooks/hard-eng.py. Since this script is not part of the skill itself but is expected to exist in the target project, it creates a vector for arbitrary command execution. A malicious repository could provide a compromised version of this script to gain control over the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from the target codebase, including PRODUCT.md, DESIGN.md, and Architecture Decision Records (ADRs).
Ingestion points: The agent is instructed to read PRODUCT.md, DESIGN.md, and docs/adr/ in references/workflow.md.
Boundary markers: There are no instructions to treat these external files as untrusted or to ignore embedded instructions.
Capability inventory: The skill has significant capabilities, including shell execution through the .hooks/hard-eng.py script and various package managers (pnpm, uv).
Sanitization: There is no mention of sanitizing or validating the content of these ingested files before processing them.
[DYNAMIC_EXECUTION]: The configuration templates for Dart, JavaScript, and Python (templates/hard-eng.*.json) define complex shell command chains. For example, the Dart template uses a multi-stage pipeline involving mktemp, xargs, and trap to process project files, which is executed directly by the agent.