The Agent Skills Directory

[COMMAND_EXECUTION]: The skill heavily utilizes Bash commands to manage the implementation lifecycle, including state updates and version control automation.
Evidence: Stages 1, 2, 7, and 9 use jq, sed, and git to read task data, update statuses in state.json, and commit changes to the repository.
Context: The execution is restricted to the local workspace and uses jq --arg for safe interpolation of variables into JSON structures.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes data from potentially untrusted sources.
Ingestion points: Reads project metadata from specs/state.json and completion data (summaries, roadmap items) from a subagent-generated .return-meta.json file.
Boundary markers: The prompt for the neovim-implementation-agent subagent is constructed from context variables without explicit boundary markers or instructions to disregard embedded commands.
Capability inventory: The skill has access to Bash, Edit, Write, and Task tools, allowing for command execution and file manipulation based on the ingested data.
Sanitization: While the skill uses jq to handle JSON data safely, it does not perform sanitization or validation on the content of the project_name or subagent-provided summaries before they are used in path construction or committed to Git.

skill-neovim-implementation