The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute multiple shell commands, including ln, echo, composer, phpcs, phpstan, phpunit, eslint, and stylelint. It also executes a local script via a path containing an environment variable: ${CLAUDE_PLUGIN_ROOT}/scripts/reverify-list.sh.
[DYNAMIC_EXECUTION]: The instructions direct the agent to create symbolic links in a directory above the current project root using the pattern ln -sfv <core>/.eslintrc.passing.json <project>/../.eslintrc.json. Creating files or links outside the designated workspace boundary (path traversal) is a security risk.
[REMOTE_CODE_EXECUTION]: The skill's primary function involves running a contributor's untrusted code locally. This includes executing composer install and phpunit, both of which can run arbitrary code defined in composer.json scripts or test fixtures. The skill documentation explicitly identifies this as an untrusted code execution risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data including .gitlab-ci.yml configuration files and the contribution's source code. This represents an attack surface where malicious instructions embedded in the code or metadata could influence the agent.
Ingestion points: .gitlab-ci.yml, contribution source code (PHP, JS, CSS, YAML).
Boundary markers: None specified for the content of the processed files.
Capability inventory: Shell command execution, symlink creation, and file system writes (echo to .prettierignore).
Sanitization: No evidence of sanitization or validation of the input files before they are parsed or used to drive execution logic.

contribution-verify