The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The module _analyze_step_configurable_contract.py dynamically loads and executes Python code from the marketplace directory using importlib.util.module_from_spec() and exec_module(). It targets configurable_contract.py located within the marketplace tree. Because the marketplace root can be overridden by the user via the --marketplace-root flag, this allows for the execution of code residing in a user-provided directory.
[COMMAND_EXECUTION]: Several modules, including _analyze_manage_invocation.py, _analyze_script_call_drift.py, and _analyze_test_conventions.py, use subprocess.run() to execute shell commands. Specifically, _analyze_test_conventions.py executes arbitrary command strings defined in a JSON registry provided via the --registry argument.
[REMOTE_CODE_EXECUTION]: The analyzer _analyze_finalize_step_token.py manipulates sys.path to import find_implementors from a dynamic path within the marketplace tree, leading to the execution of code found in the components being analyzed.
[COMMAND_EXECUTION]: _analyze_manage_invocation.py and _analyze_script_call_drift.py execute audited scripts using sys.executable to capture their --help output. While this is used for interface validation, it involves running code from the audited environment.
[REMOTE_CODE_EXECUTION]: The _rule_registry.py module uses importlib.import_module() to dynamically collect descriptors from a long list of internal modules, representing a widespread pattern of dynamic code loading within the skill's own infrastructure.

plugin-doctor