The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute local Node.js utilities (gsd-tools.cjs) located within the platform's root directory. These commands are used for initializing phase operations, resolving models, and retrieving roadmap information from the project's data. All executions are targeted at trusted internal tools.
[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting external data to inform its research phase.
Ingestion points: Project-specific files including requirements, phase context, and state documents are read into the agent's context.
Boundary markers: The skill uses structured XML-style delimiters (e.g., <files_to_read>, <additional_context>) to separate untrusted data from instructions.
Capability inventory: The skill has access to Bash (for local tooling), Read (for file access), and Task (to spawn researcher subagents).
Sanitization: Inputs are normalized and validated via the gsd-tools.cjs init and roadmap get-phase commands before being used in prompts.

gsd-research-phase