The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches its core runtime components from NuGet.org and GitHub (github.com/waynebaby/Techne-Loom). These downloads are governed by a 'Dependency Acquisition Fallback Policy' that prioritizes local caches and mandates explicit user approval for network-based tool execution (L6). All binary downloads require SHA-512 verification against authoritative registration metadata.
[COMMAND_EXECUTION]: Multiple local scripts are executed to facilitate orchestration and analysis:
Node.js scripts located in assets/so-workflow/scripts/ (e.g., preflight-target-skill.js, audit-output-family-producers.js) perform static analysis and validate workflow structures.
PowerShell (AppendProgressReport.ps1) and Bash (AppendProgressReport.sh) scripts are used for progress logging, with the PowerShell script utilizing ExecutionPolicy Bypass for its local operations.
The skill commands the AI to execute the downloaded so.exe or so binary to compile and run workflows.
[REMOTE_CODE_EXECUTION]: The execution of a downloaded binary is the central function of this skill. This risk is managed through rigorous identity checks, SHA-512 hash validation, and the requirement for user consent before network acquisition.
[INDIRECT_PROMPT_INJECTION]: The skill processes other skills' SKILL.md and agent files, creating a surface for indirect prompt injection. This is mitigated by several layers of defense:
Ingestion points: Untrusted data enters the context during target skill inspection in preflight-target-skill.js and inspectExistingSkillMarkdown.
Boundary markers: The system uses 'bounded shared review contexts' and 'evidence quote verification' to ensure data integrity during analysis.
Capability inventory: The skill has permissions to write files and execute local processes.
Sanitization: Structured JSON parsing and strict path validation prevent data from escaping its intended scope or influencing logic unexpectedly.
[DYNAMIC_EXECUTION]: The framework uses Node.js scripts to generate or modify workflow JSON files and employs the so orchestrator binary to execute C# expressions at runtime for evaluating workflow logic gates.

loom-skill-enhancement