The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates the execution of local development commands such as npm run lint, npm run test, and git status to verify project compliance. These operations are essential to the skill's primary purpose of enforcing engineering standards.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it reads and processes untrusted project data (source code and configuration files) to perform automated code reviews and fixes.
Ingestion points: Project files in the src/ directory, standards.md, and package.json are read and analyzed by the scripts/governance-check.mjs and templates/audit-standards-template.mjs scripts.
Boundary markers: The agent instructions do not specify any delimiters or warnings to ignore instructions that might be embedded in the analyzed code or comments.
Capability inventory: The agent is granted Write, Edit, and Bash capabilities, which it is instructed to use to "fix ALL issues immediately" and commit those changes to the repository.
Sanitization: File content is processed as plain text without any specific sanitization or escaping before being evaluated by the agent.

governance