The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes npx skills ls -g --json via subprocess.run in lib/workflow_state/parity.py to identify installed skills for parity verification.
[EXTERNAL_DOWNLOADS]: The parity check logic utilizes npx, a well-known developer tool, which may fetch the skills package from the official npm registry if it is not present in the local cache.
[REMOTE_CODE_EXECUTION]: In lib/workflow_state/inventory.py, the skill uses importlib.util to dynamically load and execute logic from other local scripts within the repository, such as manage_proposals.py. This mechanism is used to resolve cross-skill configuration.
[PROMPT_INJECTION]: The skill processes untrusted repository artifacts, which represents a surface for indirect prompt injection.
Ingestion points: Reads slice-traceability.md and registry.json in lib/workflow_state/inventory.py.
Boundary markers: None present; the parser identifies structured table and JSON data directly.
Capability inventory: Includes command execution (subprocess.run) and dynamic code loading (importlib).
Sanitization: Data is parsed into structured models but not explicitly sanitized before being presented to the agent.

trace-artifacts