The Agent Skills Directory

[SAFE]: The skill logic is transparent and focuses entirely on structured software development processes. It interacts with local project files (e.g., package.json, requirements.txt) and documentation in a manner consistent with its stated purpose as a workflow orchestrator.
[COMMAND_EXECUTION]: To verify that code implementation matches specifications, the skill is designed to detect and execute project-native test runners, such as npm test, pytest, go test, cargo test, mvn test, or gradle test. This execution is a core feature of the development workflow and is confined to the local project environment.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads and extracts requirements from project source code and specification files which are considered untrusted inputs.
Ingestion points: Specification files located in docs/specs/ and project source/test files are read during Phase 6 (Verify) and Phase 7 (Review).
Boundary markers: The instructions do not define specific delimiters or provide the agent with explicit instructions to ignore potentially malicious directions embedded within the processed code or documentation.
Capability inventory: The skill utilizes file system access (read/write) and shell command execution (for running test suites).
Sanitization: No explicit sanitization or filtering of the content extracted from the project's files is described in the workflow.

spec-dd