The Agent Skills Directory

Command Execution: The skill executes local Python scripts and git commands via the Bash tool to perform repository analysis, metadata recording, and report rendering. These operations are scoped to the project's internal scripts and standard version control tasks necessary for its primary function.
Dynamic Context Injection: The SKILL.md file uses shell command injection placeholders to display the current UTC time and list existing report directories when the skill is initialized. These commands (date and find) are used for informative purposes and are restricted to safe, non-modifying operations.
Indirect Prompt Injection Surface: As a codebase scanner, this skill inherently ingests untrusted code from the repository. The instructions provide significant mitigations by explicitly mandating that all repository content, subagent outputs, and findings be treated as data for review, never as executable instructions. Furthermore, a multi-agent verification panel is used to scrutinize proposed findings, adding a layer of validation against adversarial data.
System Command Access: The tool optionally interacts with the GitHub CLI (gh) for pull request searching when the user has provided the necessary permissions and authentication. This interaction is gated and relies on established developer tools.
Data Transparency and Trust Model: The skill provides clear disclosures regarding its trust model, stating that it runs with the user's permissions and recommending the use of external sandbox environments for scanning untrusted code. It avoids making unauthorized network calls, except for the explicit pull-request search feature.

claude-security