The Agent Skills Directory

[COMMAND_EXECUTION]: The script goal-verify.js uses execSync to run shell commands defined in the project's .cursor/goal.config.yml. This functionality is the primary purpose of the skill, allowing the agent to verify its work against the project's own test suite and linters.
[PROMPT_INJECTION]: The skill accepts user input via the /goal command, creating a surface for indirect prompt injection. This is explicitly addressed in the intake-protocol.md and the goal-intake agent instructions, which define a 'Trust Boundary' requiring the agent to treat user objectives as intent data only and to ignore any embedded directives that attempt to override safety rules or system instructions.
[SAFE]: The skill's infrastructure consists of Node.js scripts and markdown-based subagents that manage state, time tracking, and hierarchical planning. All operations are confined to the local project directory and the standard IDE environment, with no detected exfiltration or malicious persistence patterns.

goal-mode