The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external command-line tools like cargo, clippy, and git via subprocess.run in scripts/run_external_tools.py and scripts/analyze_diff.py. This execution is the intended primary purpose of the tool, enabling it to provide deep analysis, and is implemented safely with shell=False and list-based arguments to prevent injection.
[DYNAMIC_EXECUTION]: The skill utilizes importlib.import_module in scripts/runner.py to dynamically load its internal detector modules. This is a standard architectural pattern for its multi-processed analysis engine and does not involve loading untrusted external code.
[INDIRECT_PROMPT_INJECTION]: The skill has a risk surface for indirect prompt injection as it ingests untrusted code from external Rust files in scripts/rsproject.py.
Ingestion points: Reads .rs and Cargo.toml files from the user's project directory.
Boundary markers: The reports generated in scripts/format_findings.py use markdown tables and cards. Findings are escaped (e.g., pipe characters) to maintain document structure.
Capability inventory: Executes cargo, git, and Python subprocesses. It also allows for optional execution of test suites (--run-tests) which involves running user-provided code.
Sanitization: Basic escaping is performed on code snippets before interpolation into the final report artifacts.

rust-code-doctor