The Agent Skills Directory

[COMMAND_EXECUTION]: The skill mandates the execution of multiple Python scripts located in subdirectories (e.g., python .agent/skills/vulnerability-scanner/scripts/security_scan.py .). These commands run with the agent's privileges to perform audits and validations.
[DYNAMIC_EXECUTION]: The instructions direct the agent to dynamically select and execute scripts based on its assigned role (e.g., frontend-specialist, test-engineer) using the python interpreter on local file paths.
[INDIRECT_PROMPT_INJECTION]: The skill requires the agent to capture, parse, and summarize the output of external scripts. This creates a vulnerability surface where a malicious or compromised script could output instructions that the agent might follow during the 'Parse the output' or 'Fix the errors' stages.
Ingestion points: Capturing all output from validation scripts (SKILL.md).
Boundary markers: Uses a markdown header format (## Script Results) but lacks specific delimiters to isolate potentially untrusted script output from agent instructions.
Capability inventory: The skill utilizes Read, Write, and Edit tools, as well as shell execution for Python scripts.
Sanitization: No sanitization or filtering of script output is specified before the agent processes and acts upon it.

clean-code