The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and the accompanying scripts/task helper facilitate the execution of shell commands such as node, npm, and printf. These tools are used to interact with the local Symphony project, manage task states, and build the CLI from source when necessary within the user's local GitHub directory environment.
[EXTERNAL_DOWNLOADS]: The helper script automatically invokes npm run build if the project's distribution files are missing. While this operation may download dependencies from official package registries, it is a standard part of the software development lifecycle for the targeted environment.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting data from external Symphony work items which could potentially contain malicious instructions.
Ingestion points: Work item details are fetched from the local Symphony task client using the task get command through the Python CLI helper.
Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" warnings when processing the data returned by the task client.
Capability inventory: The skill is authorized to perform repository-level work (commits, hooks, pushes), execute build scripts via npm, and update task status via the CLI.
Sanitization: Content fetched from work items is passed through the system without explicit sanitization or validation routines before being used to inform agent actions.

symphony