The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various shell commands to perform project verification. It includes logic to detect the active package manager (npm, yarn, pnpm, or bun) and execute scripts defined in the project's local configuration (e.g., package.json). It also invokes standard CLI tools like pytest, cargo, go test, and forge based on the detected project type.
[DATA_EXPOSURE]: The skill reads local project metadata including package.json scripts and CI workflow files to determine appropriate verification steps. It processes the output of these commands to generate a summary report. No access to sensitive system directories or network exfiltration patterns were identified.
[SAFE]: All identified behaviors are consistent with the skill's stated purpose of providing a verification feedback loop for developers. No obfuscation, unauthorized remote downloads, persistence mechanisms, or privilege escalation attempts were detected. The use of standard tools and the local scope of operations align with security best practices for development assistants.
[PROMPT_INJECTION]: Indirect surface exists as the skill processes data from project files and command outputs which could theoretically contain malicious instructions.
Ingestion points: Project configuration files (package.json, CI workflows) and terminal output from executed tests/builds.
Boundary markers: Not explicitly defined in instructions.
Capability inventory: Subprocess execution for development tools (npm, ruff, cargo, etc.).
Sanitization: Implements output truncation using head to manage the volume of data processed by the agent.

verify-changes