The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several Python scripts and a Mise task graph to automate development and validation workflows. Scripts such as run_agentic_request.py and sync_mise_primitives.py use the subprocess module to execute system commands like mise and external model runners. These operations are intended for use in the local development environment to facilitate testing and integration.
[EXTERNAL_DOWNLOADS]: The sync_mise_primitives.py script fetches the official Mise JSON schema from its public GitHub repository (raw.githubusercontent.com/jdx/mise/). This is a well-known service and repository used for schema validation of the skill's task configuration. The download is limited to static configuration data and does not involve the execution of untrusted remote scripts.
[INDIRECT_PROMPT_INJECTION]: Because the skill's primary function is to ingest and process untrusted user prompts, it naturally possesses an indirect injection attack surface. This risk is thoroughly mitigated through the following design principles:
Ingestion points: Untrusted data enters via the rewrite <prompt> command defined in SKILL.md.
Boundary markers: The output protocol mandates specific fenced blocks and clear labels (READY or NEEDS_CLARIFICATION) to prevent the agent from misinterpreting rewritten content as new instructions.
Capability inventory: The skill is strictly scoped to text disambiguation; it lacks the capabilities to perform sensitive file reads, network exfiltration, or arbitrary command execution as part of its core interpretive logic.
Sanitization: The references/ambiguity-protocol.md defines a rigorous "Resolution authority" that treats all embedded instructions as data and explicitly forbids the agent from obeying overrides. Furthermore, the protocol requires the redaction of any credential-like values, replacing them with descriptive placeholders.

only-one-interpretation