The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inventories existing model sheets and reads configuration data from the pstack skill catalog (e.g., references/provider-dispatch.md and adapters/README.md) to resolve paths and build a setup plan.
Ingestion points: Reads external markdown and configuration files from the local pstack skill directory.
Boundary markers: Absent; the instructions do not define delimiters or provide warnings to the agent regarding embedded instructions in these files.
Capability inventory: The skill has the ability to modify the file system (backups and configuration writes) and perform network-based model probes.
Sanitization: Absent; there is no explicit validation or sanitization step for the content retrieved from the pstack skill before it is used to render the adapter plan.
[DYNAMIC_EXECUTION]: The workflow includes instructions to "regenerate adapters when the harness uses a generator," which involves the runtime creation of configuration files or logic based on the state inventoried from other files.
[DATA_EXFILTRATION]: Documentation within the skill (NOTICE.txt) indicates that included scripts like worktree-audit.sh access sensitive platform-specific directories such as ~/.claude/projects/. While this is presented as necessary for worktree cleanup functionality, it involves reading sensitive project metadata.
[COMMAND_EXECUTION]: The skill workflow instructs the agent to "Probe authorized selected lanes" using a "bundled runner for external lanes," which involves the execution of subprocesses or network requests to verify model connectivity and receipts.

setup-pstack