The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/lint_runner.py executes local CLI tools, including npm, npx, ruff, and mypy, to perform code validation. These commands are invoked using subprocess.run with fixed argument lists, which is a secure implementation that prevents shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files, such as package.json and source code, to perform its analysis. While a malicious project could attempt to influence the agent via linter output or by defining malicious scripts in configuration files, this is an inherent characteristic of code auditing and quality control tools rather than a specific vulnerability in the skill itself.

lint-and-validate