The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/lint_runner.py utilizes subprocess.run to execute development commands such as npm run lint, npx tsc, ruff check, and mypy. These commands are triggered based on the detection of standard project manifest files (e.g., package.json, pyproject.toml) and are executed within the project directory.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the following factors:
Ingestion points: scripts/lint_runner.py reads project manifests like package.json, while scripts/type_coverage.py reads all .ts, .tsx, and .py source files within the target directory.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded malicious content within the analyzed files.
Capability inventory: The skill has the ability to execute shell commands via subprocess.run in scripts/lint_runner.py.
Sanitization: The skill performs no sanitization or validation of the content read from files before it is processed or used to determine linter execution. The risk is considered low as the actions are confined to standard local development tooling.

lint-and-validate