The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local scripts (e.g., 'build-codex-artifacts.js') and standard CLI tools like 'git', 'node', and 'bash' to initialize the development environment. This behavior is consistent with the stated purpose of a setup tool for the sd0x-dev-flow framework.
[COMMAND_EXECUTION]: The skill installs git hooks ('commit-msg', 'pre-push') by modifying the '.git/hooks' directory or project-specific configurations like Husky. While this establishes a persistence mechanism (code execution on git events), it is the primary intended function of the tool and a standard industry practice for development workflow automation.
[PROMPT_INJECTION]: The skill reads project metadata from 'package.json' and 'CLAUDE.md' to populate an 'AGENTS.md' instruction file. Although this creates an indirect prompt injection surface (where malicious project metadata could influence agent behavior), the generated rules themselves emphasize security best practices, such as avoiding secret commits and validating URLs.

codex-setup