The Agent Skills Directory

[COMMAND_EXECUTION]: Several scripts, including scripts/finish-lane.ts and review-patterns/scripts/build-version-spine.py, use subprocesses to execute Git commands, the GitHub CLI (gh), and various package managers (npm, yarn, pnpm, bun). These commands are used to derive repository state, fetch release metadata, and run local build tools.
[DYNAMIC_EXECUTION]: The scripts/finish-lane.ts utility dynamically discovers and executes validation scripts defined in the local repository's package.json (e.g., npm run validate or npm run test). This is a core feature designed to ensure PR readiness by running the project's own verification suite.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes arbitrary source code from the repository (e.g., via scripts/clean-code-scan.py) to provide clean-code suggestions and PR reviews. This ingestion of untrusted data represents a potential attack surface, although the skill includes instructions for the agent to treat these outputs as "leads" rather than authoritative commands.
Ingestion points: scripts/clean-code-scan.py and scripts/finish-lane.ts ingest code from the local filesystem and git diffs.
Boundary markers: The instructions explicitly state that scanner outputs and suggested lenses are for guidance and require independent agent judgment.
Capability inventory: The skill has access to Write, Edit, and Bash tools for code remediation.
Sanitization: Code analysis in clean-code-scan.py is performed using Python's ast module, providing a structured and safe way to inspect code patterns.

code