The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses several Python scripts (check_env.py, daemon_ctl.py, run_with_env.py) to execute system commands such as node, pnpm, and corepack. These executions are performed securely using subprocess.run and subprocess.Popen with shell=False. The run_with_env.py script specifically implements an allow-list for permitted commands and arguments, ensuring the agent cannot execute arbitrary shell commands.
[DATA_EXFILTRATION]: Network activity is restricted to local communication. The daemon_ctl.py and list_skills.py scripts include a validate_daemon_url function that strictly enforces that the daemon host must be a loopback address (127.0.0.1, localhost, or ::1). This prevents the skill from being used to exfiltrate data to remote servers.
[PROMPT_INJECTION]: The skill is designed to ingest DESIGN.md files from user projects. This presents an indirect prompt injection surface. However, the risk is mitigated by the skill's design, which focuses on atomic, verifiable operations and explicitly instructs the agent to perform read-only checks and seek user confirmation before any destructive actions or file overwrites.
[EXTERNAL_DOWNLOADS]: The documentation references cloning the upstream Open Design repository from GitHub as a prerequisite. These references are transparently documented as part of the setup process and target the relevant project repository.
[CREDENTIALS_UNSAFE]: The skill implements a secure configuration model. It uses a private config.yml file and process environment variables to store paths and ports. The open_design_env.py script limits environment loading to a specific set of allowed keys, and the SKILL.md instructions explicitly forbid printing configuration or environment values in logs.

soia-dev-open-design-ops