The Agent Skills Directory

[COMMAND_EXECUTION]: The drift_analyzer.py and doc_staleness_scorer.py scripts utilize subprocess.run to invoke the git binary for repository analysis. These calls use argument lists rather than shell strings, which is a security best practice that prevents shell injection vulnerabilities by ensuring that user-provided paths or dates are not interpreted as shell commands.
[EXTERNAL_DOWNLOADS]: The link_checker.py script contains functionality to validate external URLs using urllib.request. This behavior is disabled by default and requires the explicit --check-external flag. When active, it performs standard HTTP HEAD and GET requests for the legitimate purpose of link verification, using a custom User-Agent identifying the tool.
[DYNAMIC_EXECUTION]: The api_doc_validator.py script employs the Python ast module to parse source code. This is performed via static analysis (ast.parse followed by ast.walk) to extract function and class signatures without executing the target code, posing no runtime execution risk to the host environment.
[DATA_EXPOSURE]: The scripts read local repository metadata such as package.json, pyproject.toml, and .git logs to perform drift calculations. This access is restricted to the target repository directory provided by the user and is consistent with the skill's primary function of documentation and code auditing.

doc-drift-detector