The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a series of standard development commands for building and testing projects across Python and Node.js environments. Evidence includes execution of uv build, npm run build, pytest, and tsc.
[CREDENTIALS_UNSAFE]: Includes a dedicated security phase that proactively searches for hardcoded credentials (such as API keys with sk- prefixes) in the source code. This is a defensive audit feature and not a credential exposure issue within the skill itself.
[PROMPT_INJECTION]: The skill processes external data from command outputs (build logs, test failures), which constitutes a potential surface for indirect prompt injection. This is mitigated by the skill's structured output format and the use of piping tools like head and tail to limit the ingested context.
Ingestion points: Command-line output from external tools like pytest and ruff.
Boundary markers: Findings are encapsulated within a defined VERIFICATION REPORT structure.
Capability inventory: Subprocess calls via bash for uv, npm, pip-audit, and git.
Sanitization: Implements context limiting via head -30 and tail -20 on tool outputs.

verification-loop