The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script scripts/with_server.py utilizes subprocess.Popen with shell=True to execute commands for starting local development servers. This is an intended functional pattern designed to support complex startup sequences (e.g., using cd or &&) when automating web application tests.
[COMMAND_EXECUTION]: Automation scripts such as scripts/make-verify-run.sh and scripts/make-verify-run.ps1 execute local make targets (lint, test, typecheck) to facilitate the verification of code changes.
[DATA_EXPOSURE]: The documentation file references/anti-patterns.md contains an example of a database connection string with hardcoded credentials. This is explicitly presented as an anti-pattern to avoid, serving as an educational example of insecure practices.
[DATA_EXPOSURE]: The scripts/browser_trace.py script records comprehensive browser activity—including network requests, headers, and DOM snapshots—to a local directory. This is a legitimate diagnostic feature used for debugging and reverse-engineering application behavior as documented in the skill.
[INDIRECT_PROMPT_INJECTION]: The skill includes several static analysis tools (security_scanner.py, vulnerability_assessor.py, compliance_checker.py) that ingest data from the files they scan. This creates a standard surface area where content in a scanned repository could theoretically influence the analyzer, though the implementation relies on predictable regex-based patterns.
[EXTERNAL_DOWNLOADS]: The skill documentation correctly identifies and recommends several well-known security tools and libraries from established organizations such as Snyk, OWASP, and various cloud provider SDKs.

quality-assurance