The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts (such as api.py and observe.py) and repository-specific tools (build, lint, test) using subprocess.run as part of its legitimate task-management and pipeline orchestration functions.
[SAFE]: Authentication is handled through a zero-dependency helper script (api.py) that resolves the SQUAD_AUTH_TOKEN from the environment or a local config file. The token is treated as an opaque credential and is never exposed in process listings or logs.
[SAFE]: The skill implements a robust privacy gate via observe.py, which includes a deterministic opt-in check and a reject-on-detect leak filter. This filter scans for sensitive patterns like emails, URLs, IP addresses, and high-entropy secrets, redacting them before any observation data is sent.
[SAFE]: Core logic for state transitions and prompt rendering is contained in local scripts rather than being left to model discretion, which mitigates the risk of prompt injection influencing critical operations.
[SAFE]: Communication is directed to vendor-owned infrastructure (steloit.com and associated Google Cloud Run endpoints), which is consistent with the skill's stated purpose of managing tasks on the Squad board.

squad