The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's core functionality involves downloading and executing code from external repositories and pull requests. The install and test_cmd functions in scripts/verify_env.py facilitate the execution of third-party code through dependency installation (e.g., npm install, pip install -e .) and test runner invocation (e.g., pytest, jest, go test).
[COMMAND_EXECUTION]: The script scripts/verify_env.py makes extensive use of subprocess.run to execute system commands including git for repository management, gh for GitHub interaction, and various language-specific build and test tools. While it correctly uses argument lists to prevent shell injection, it still executes these powerful tools with user-supplied paths and identifiers.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch pull request data from GitHub and to download project dependencies from public registries like NPM, PyPI, and the Go module proxy. These operations are triggered during the verification workflow.
[DATA_EXFILTRATION]: The script reads repository metadata, file contents, and test execution logs (stdout/stderr). This data is returned to the agent's context, creating a surface where malicious content in a repository (e.g., in a package.json or test file) could attempt to influence the agent's behavior through indirect prompt injection.

repo-verify