The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The references/selene.md file suggests an installation method for the selene utility using a piped remote script: curl -fsSL https://raw.githubusercontent.com/danicat/selene/main/install.sh | bash. This pattern involves executing an unverified script from an external source directly in the shell, which bypasses security verification.\n- [COMMAND_EXECUTION]: The skill coordinates the execution of numerous Go toolchain components and third-party analysis binaries (such as golangci-lint, modernize, and deadcode) through agent-triggered commands based on repository configuration.\n- [PRIVILEGE_ESCALATION]: The smart_edit tool allows the agent to modify any file using absolute paths provided in the payload. While edits are guarded by a compiler rollback gate, the capability to perform arbitrary file writes represents a significant privilege surface.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including source code and test execution metrics, creating a potential surface for indirect instruction processing.\n
Ingestion points: Go source code files (SKILL.md) and test outcomes/logs stored in testquery.db (references/testquery.md).\n
Boundary markers: Employs compiler validation and atomic file operations but does not implement specific delimiters or instructions to isolate data from agent instructions.\n
Capability inventory: Capabilities include arbitrary file writing (smart_edit), multi-tier command execution (smart_build, smart_test), and documentation inspection (read_docs).\n
Sanitization: There is no documented sanitization or escaping of strings extracted from source code comments or test output logs before they are ingested into the context.\n- [DYNAMIC_EXECUTION]: The skill's architecture relies on discovering and invoking external binaries from the system path or a local configuration file (.godoctor.yaml). This configuration-driven execution model constitutes a dynamic execution surface that could be targeted for tool subversion.

godoctor