The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several well-known and reputable development and security tools, including Lighthouse, Semgrep, Gitleaks, and osv-scanner, using standard package managers (npm, pip, brew). These tools are recognized as well-known services for code quality and security.
[COMMAND_EXECUTION]: The skill defines a workflow for running various CLI tools (e.g., tsc, eslint, vitest, gitleaks, semgrep) to verify repository state. These commands are standard for modern CI/CD pipelines and are used here to enforce project-specific quality gates.
[DYNAMIC_EXECUTION]: The skill includes a reference implementation for a 'floor-guard' utility in JavaScript (floor-guard.mjs). This script is a template designed to be adapted for different stacks. It uses child_process.execFileSync to execute local git commands for diff-scoped enforcement of quality standards. The script is locally generated from the provided text and does not execute untrusted remote code.
[INDIRECT_PROMPT_INJECTION]: The skill introduces a vulnerability surface by instructing the agent to read and follow project-specific instructions in CONSTRAINTS.md, which is a repository file that could be influenced by external contributors.
Ingestion points: Reads package.json, pyproject.toml, .github/workflows/, and CONSTRAINTS.md (SKILL.md).
Boundary markers: Includes instructions for the agent to 'Read CONSTRAINTS.md before writing code' and to not weaken the constraints to make changes pass.
Capability inventory: Can execute shell commands via project scripts and the floor-guard.mjs utility, including file-system reads and repository analysis.
Sanitization: The skill explicitly mandates the use of the --redact flag for secret scanning tools and instructs the floor-guard script to report rule violations and locations without printing sensitive matched text (e.g., secrets).
[SAFE]: The overall intent and implementation of the skill are consistent with best practices for automated code quality and security enforcement. The resource references (e.g., GitHub repositories and tool homepages) point to legitimate, well-known organizations.

constraint-driven-development