The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs shell commands (e.g., rg, find, bash) for repository inspection and uses the gh CLI for retrieving branch protection metadata and posting PR comments. In "audit+fix" modes, it executes package management commands (e.g., pip install, bun add) to set up development harnesses.
[EXTERNAL_DOWNLOADS]: In its fix templates, the skill automates the installation of standard development tools (e.g., ruff, pre-commit, husky, biome) from official registries like PyPI and npm. It also configures hooks that reference official public repositories for tool definitions.
[PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it reads and analyzes untrusted files (e.g., AGENTS.md, rules/, CONTRIBUTING.md) from the codebase being audited. Malicious instructions in these files could theoretically attempt to influence the agent's audit findings or subsequent fix operations, although the skill's adherence to a strict 8-artifact framework serves as a mitigating factor.

harness-audit