The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents and manages the execution of shell commands such as make build-skills, npm install, pip install, and git push.
Evidence: Found in SKILL.md and assets/approval-gate-spec.md.
Context: These capabilities are explicitly defined as 'Mutating Actions' that are prohibited from automatic execution. The skill mandates a 6-step blocking approval workflow (Preflight -> Present changes -> Approval ask -> Wait -> Execute -> Verify) for any such command, ensuring high user oversight.
[DATA_EXPOSURE]: The skill performs local file system reads to analyze and audit other skills.
Evidence: SKILL.md describes reading source files from .agents/skills/<name>/SKILL.md and loading summaries from .agents/skills/*/SKILL.md.
Context: This is a localized operation required for the skill's primary purpose of auditing and overlap detection. No network exfiltration or access to sensitive user credentials (like .ssh or .aws) was detected.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests content from external skill files to audit them.
Ingestion points: SKILL.md reads content from other skill definitions in .agents/skills/.
Boundary markers: The skill applies references/GUARDRAILS.md and assets/adaptation-checklist.md which include explicit 'Safety Carve-Outs' and instructions to never weaken security controls.
Capability inventory: The skill can generate file structures and propose shell commands, but all execution is gated by the mandatory approval protocol.
Sanitization: The skill's primary function is to sanitize and wrap external logic into safe, Socratic, and user-approved flows.
[SAFE]: The skill incorporates extensive security best practices including:
Human Decision Ownership: Explicitly prevents the agent from making architectural or security decisions without user choice.
Execution Approval Gates: A strict blocking protocol that prevents silent or 'autopilot' command execution.
Safety Carve-Outs: Non-negotiable rules in assets/philosophy-core.md that prohibit the agent from weakening trust-boundary validation, security controls, or data-loss prevention.

duck-adapt