The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/unslop_survey.py script invokes npx -y impeccable detect. This downloads and runs a package from the NPM registry at runtime without specific version pinning or integrity validation, posing a risk of supply chain compromise.
[COMMAND_EXECUTION]: The skill uses subprocess.run to call git and other tools. The configuration via the UNSLOP_DETECTOR environment variable or the --detector-cmd parameter allows the agent to execute arbitrary shell commands.
[PROMPT_INJECTION]: The skill analyzes untrusted code and generates reports that direct the agent's autonomous workflow. Maliciously crafted comments in a scanned repository could inject instructions that influence the agent's subsequent 'Root plan' or 'Direction' steps.
Ingestion points: Code files read by scripts/unslop_survey.py.
Boundary markers: No sanitization or markers for extracted code snippets in the report.
Capability inventory: The agent can modify code, execute scripts, and create pull requests.
Sanitization: Content from the target repository is not sanitized before being placed into the report.
[EXTERNAL_DOWNLOADS]: The skill relies on external tools and package registries (NPM) to function, introducing external dependencies that are resolved at runtime.

unslop