The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to integrate with common developer tools and the project's own manage.py script. These calls are used for legitimate purposes:
In scripts/analyze_diff.py, it uses Git to identify changed lines for targeted analysis.
In scripts/run_external_tools.py, it provides optional integration with django-upgrade, djlint, mypy, bandit, and pip-audit.
The tool explicitly warns users in SKILL.md and script comments that some operations (like --run-migrations-check) will execute project code or mutate files (--fix), and it does not install these dependencies automatically, providing installation hints instead.
[DYNAMIC_EXECUTION]: The analyzer uses the standard library ast module to parse and model source code without executing it. This is a safe and standard approach for deep code analysis in Python.
[DATA_EXFILTRATION]: No evidence of unauthorized network activity or data exfiltration was found. Network-capable tools like pip-audit are industry standards for dependency checking and are only invoked at the user's request.
[PROMPT_INJECTION]: The skill's instructions and reference guides focus strictly on Django best practices and do not contain patterns attempting to bypass agent safety filters or override core behavior.

django-code-doctor