The Agent Skills Directory

[SAFE]: The skill implements a 'Least Privilege' design by separating the proposal of changes from their application. It specifically restricts itself to only applying patches that have been staged in a specific directory (.aris/meta/pending/).
[COMMAND_EXECUTION]: The skill uses bash to check for staged patches and execute a provenance.py script. These operations are restricted to internal maintenance and auditing of the skill corpus. The logic includes a 'Rule 3' that validates the provenance of scripts to prevent same-family model collusion.
[PROMPT_INJECTION]: The skill contains explicit instructions to ignore 'advisory' verdicts written by other skills, preventing potential injection or bypass attempts from earlier stages in the pipeline. It requires a fresh, independent jury verdict at the time of application.
[SAFE]: The skill uses structured data logging (jsonl) and mandatory backups before file mutations, following robust safety procedures for self-modifying code environments.
[REMOTE_CODE_EXECUTION]: While the skill mentions calling an external mcp__codex__codex tool for jury review, this is a scoped tool call to a reasoning model for evaluation purposes, not an arbitrary remote code execution vulnerability. The sandbox: read-only configuration for the jury further mitigates risk.

meta-apply