The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs shell operations including git clone, mkdir, git init, and jq. It incorporates an 'Input Validation' section that instructs the agent to reject paths or names containing shell metacharacters such as backticks, dollar signs, semicolons, and pipes to mitigate command injection risks.
[EXTERNAL_DOWNLOADS]: The skill is designed to clone external Git repositories. While the default source is a vendor-controlled repository, the capability to clone any user-provided URL is present. The instructions emphasize that the agent should only clone trusted repositories and must validate that URLs use the https scheme.
[PROMPT_INJECTION]: The skill establishes a surface for indirect prompt injection by configuring the project to ingest and follow instructions from an external directives repository (markdown files, skills registry, and MCP configs).
Ingestion points: Data enters via git clone from remote URLs and local path resolution.
Boundary markers: Uses  markers in the project's AGENTS.md to delimit injected instructions.
Capability inventory: Includes file system writes, Git operations, and execution of shared helper scripts.
Sanitization: Relies on explicit instruction-based validation of paths, URLs, and team names before execution.
[COMMAND_EXECUTION]: The shared utility scripts (team-helpers.sh and team-helpers.ps1) perform file system manipulations and project wiring. The Bash implementation utilizes Python one-liners to safely parse and manipulate JSON configuration files without relying on unsafe shell interpolation.

team-setup