The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/check-contract.py script uses subprocess.check_output to execute git rev-parse HEAD. This is a benign operation used to verify the current repository state and ensure consistency with the generated behavioral contracts. It uses a list of arguments (shell=False), preventing shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON metadata files (boundaries.json, manifest.json, and contract definitions) to validate the system's behavior. While this involves reading external file paths and hashes, the validation logic is strictly scoped to existence and integrity checks. The script reports success or failure and does not output file contents, minimizing the risk of data exposure or instruction override.
[DATA_EXPOSURE]: The skill instructions (Step 4.2) explicitly mandate the removal of personal information (PII) and secrets from fixtures before they are recorded in the contract, demonstrating follow-the-best-practice security awareness.

recover-behavioral-contracts