The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's verification workflow (Step 3) instructs the agent to execute code from the audited repository using bun -e to verify factual claims like object lengths. This involves importing modules from the user's project at runtime.
Evidence: SKILL.md contains the instruction: bun -e 'import { X } from "./m.ts"; console.log(Object.keys(X).length)'.
Risk: If the repository being audited contains malicious top-level code or side effects within its modules, importing them to verify a comment will trigger their execution in the agent's environment.
[COMMAND_EXECUTION]: The skill uses shell commands via Bash(bun:*) and Bash(rg:*) to perform its tasks. While these are mostly used for scanning, the bun -e execution path poses a risk of arbitrary command execution if the audited code contains sub-processes.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (code comments) from external repositories and uses that data to drive its classification and editing logic.
Ingestion points: The agent reads all comments in a file or diff (Step 2) to apply the classification grid.
Boundary markers: The skill does not use specific XML delimiters for comments but relies on a custom TypeScript parser (check-cited-paths.ts) to isolate comment segments.
Capability inventory: The skill has Edit, Read, and Bash capabilities, allowing it to modify files based on its analysis.
Sanitization: The instructions provide a strict "Decision grid" and "Audit/Apply" modes to limit the agent's actions, which serves as a logical constraint against malicious instructions embedded in comments.

clean-comments