The Agent Skills Directory

[COMMAND_EXECUTION]: The skill defines phases to execute standard development tools such as uv build, npm run build, npx tsc, pyright, ruff, and pytest. These are legitimate operations for a verification-focused skill.\n- [EXTERNAL_DOWNLOADS]: Commands like pip-audit and npx are utilized, which fetch data or packages from official and well-known registries (PyPI and NPM). These are standard practices in modern software development and are used here for security auditing and build tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it reads project files to perform analysis.\n
Ingestion points: Project source files read by build and lint tools during all verification phases.\n
Boundary markers: None defined to isolate instructions within source code.\n
Capability inventory: Shell execution for building, testing, and linting, as well as file system read access.\n
Sanitization: Not implemented; the skill relies on the diagnostic output of the invoked tools.\n- [CREDENTIALS_UNSAFE]: Includes defensive security checks using grep to scan for hardcoded secrets like API keys (sk-, api_key) to prevent them from being included in PRs. This is a security-enhancing feature rather than a vulnerability.

verification-loop