The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts, specifically _state.py, execute the git command-line utility via subprocess.run to retrieve repository metadata (e.g., rev-parse, ls-files, status). These operations are limited to standard, read-only Git queries necessary for calculating product fingerprints and verifying the repository state.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied SOP files (YAML) and test results (JSONL) that contain natural language instructions. While the skill performs extensive structural and type validation, the content of these files is intended to be interpreted by the AI agent to draft scenarios and reports, which represents a potential surface for indirect prompt injection if the source files are maliciously crafted.
[DYNAMIC_EXECUTION]: The included test suite (test_sop.py) utilizes subprocess to launch the main sop.py script and git commands during automated testing. This is standard practice for unit testing a command-line utility and does not pose a threat in production usage.

sop-verify