The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/kb.py interacts with local or remote Git repositories using subprocess.run to manage knowledge base content. It ensures security by using list-based arguments and strictly validating commit SHAs and file paths through regular expressions and canonical path checks.
[EXTERNAL_DOWNLOADS]: The skill programmatically fetches engineering and business documentation from Aliyun Codeup (openapi-rdc.aliyuncs.com) using the official Alibaba Cloud OpenAPI. These network operations are authenticated via environment variables and are central to the skill's functionality as a knowledge-based assistant.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection as it is designed to ingest and analyze untrusted external data (project source code) during the review process. This risk is mitigated by the skill's lack of high-privilege capabilities and its adherence to a robust set of predefined backend development rules.

oneos-work-delivery