The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Instructions and scaffolding scripts recommend installing the uv package manager via a piped shell script from the Astral domain.
Evidence: The command curl -LsSf https://astral.sh/uv/install.sh | sh is present in the documentation comments of scripts/go/new-project.py, scripts/python/new-project.py, scripts/rust/new-project.py, and scripts/python/new-script.py. Astral is a well-known and trusted service provider in the Python ecosystem.
[COMMAND_EXECUTION]: The skill provides Python and TypeScript scripts to automate the creation of new software projects, which involve executing local CLI tools.
Evidence: scripts/python/new-project.py calls uv init, scripts/rust/new-project.py calls cargo init, and scripts/go/new-project.py calls go mod init. These system calls use structured argument lists to avoid shell injection and are intended for project scaffolding.
[EXTERNAL_DOWNLOADS]: The skill references and suggests the use of various programming libraries and configuration specifications from official registries and organizations.
Evidence: Documentation in the references/ directory specifies dependencies from official registries (PyPI, crates.io, NPM) and GitHub organizations of major frameworks like Gin, Axum, and Hono. All references target established and well-known entities in the developer community.
[PROMPT_INJECTION]: The skill processes user-provided source files for analysis and modification, creating a surface for indirect prompt injection.
Ingestion points: The skill ingests source files for Python, Rust, Go, and TypeScript to perform linting, auditing, and refactoring as defined in SKILL.md.
Boundary markers: The instructions emphasize 'parse-don't-validate' logic and type-strict boundaries, while the agent's built-in code analysis tools serve as the primary containment for untrusted input code.
Capability inventory: The skill can execute local build tools and linters via subprocesses as defined in the scripts/ directory.
Sanitization: The skill relies on standard static analysis tools (Ruff, Clippy, nilaway) which are architected to safely process and analyze untrusted source code.

programming