The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard shell commands, including git rev-parse, git diff, git ls-files, and grep. These are used to verify if the project state matches the metadata in the knowledge graph and to extract specific JSON fields efficiently without loading the entire file into context. All operations are local to the repository and do not involve elevated privileges or network activity.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a local file (knowledge-graph.json) and interpolates it into an onboarding guide. While there is a potential attack surface if the JSON file were maliciously crafted, the risk is minimal as the file is a tool-generated artifact within the user's project directory, and the skill performs basic checks on the Git commit hash metadata before processing the content.

understand-onboard