The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external shell commands to facilitate authentication and diagram validation.
In scripts/check_links.py, the subprocess.run function is used with shell=True to execute the Azure CLI tool (az account get-access-token) to retrieve authentication tokens for Azure DevOps.
In scripts/check_mermaid.py, subprocess.run is used with shell=True on Windows platforms to execute node for parsing diagrams.
[DYNAMIC_EXECUTION]: The skill performs dynamic code generation and execution to validate Mermaid diagrams.
The scripts/check_mermaid.py script writes a temporary JavaScript file (_check_mermaid_probe.mjs) containing code to import and run the mermaid and jsdom libraries. It then executes this generated script using the system's Node.js runtime.
[INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests and processes untrusted data from external systems and local project files.
Ingestion points: The skill reads content from Azure DevOps wikis (via scripts/check_links.py) and local project files, including source code and diagrams, to extract facts for documentation.
Boundary markers: The instructions do not define explicit boundary markers or delimiters when interpolating data from measured systems into the documentation context, although they emphasize a strict 'fact ledger' approach.
Capability inventory: The skill possesses capabilities for file writing (scripts/anchored_edit.py), network access to Azure DevOps APIs (scripts/check_links.py), and shell command execution (scripts/check_links.py, scripts/check_mermaid.py).
Sanitization: Content is processed using regular expressions for link extraction and Mermaid parsing, but there is no explicit sanitization or filtering of instructions that might be embedded in the system data being documented.

document-what-shipped