The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/verify-pipeline.sh script executes shell commands like npm run, cargo test, and python3 -m pytest. This is the intended functionality for code verification but relies on the integrity of the target repository's configuration files.
[PROMPT_INJECTION]: The skill processes untrusted repository data (e.g., package.json, Cargo.toml, source code) and possesses command execution capabilities through the Bash tool and a helper script.
Ingestion points: The skill reads project configuration files (package.json, Cargo.toml, pyproject.toml, requirements.txt) and source files to determine which commands to run.
Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions embedded in the project files.
Capability inventory: The skill uses the Bash tool and a custom script (scripts/verify-pipeline.sh) to execute shell commands found in the repository environment.
Sanitization: The script executes repository-defined commands (such as those defined in the scripts section of a package.json file) without prior sanitization or validation of the script content.

code-verification