The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the ! syntax in SKILL.md to execute shell commands when the skill is loaded.
Evidence: !d=${CLAUDE_SKILL_DIR}; command -v skill-toc >/dev/null 2>&1 && exec skill-toc "$d"; s=$HOME/.claude/skills/plugin-utils/bin/skill-toc; [ -x "$s" ] && exec "$s" "$d"; echo "(skill-toc unavailable...)"`.
This executes a shell script located in the user's home directory or the system PATH to generate a dynamic Table of Contents.
[COMMAND_EXECUTION]: The skill's primary management script, scripts/new-rule.ts, executes external commands through spawnSync.
Evidence: The script runs the rule-calibrate.ts script via bun to verify new rules.
The execution path for the calibrator can be overridden using the RULE_CALIBRATE environment variable, which could allow arbitrary command execution if the environment is compromised.
[DYNAMIC_EXECUTION]: The skill generates and then executes new code files as part of its core functionality.
Evidence: scripts/new-rule.ts writes new Python rule modules (.py) and TypeScript test files (.test.ts) using templates defined within the script.
These generated files are subsequently executed by the test runner and the evidence.py collector.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests user-provided identifiers to generate executable code.
Ingestion points: User-supplied <set> and <ID> arguments in scripts/new-rule.ts are interpolated into file paths and source code strings (e.g., constraints/jev/${setName}/${id}.py).
Boundary markers: No explicit boundary markers or security warnings are included in the generated code templates to prevent malicious instructions from being processed as part of the rule logic.
Capability inventory: The skill has the ability to write files (writeFileSync), move files (renameSync), and execute shell commands (spawnSync) across several scripts including scripts/new-rule.ts and scripts/new-rule.test.ts.
Sanitization: There is basic regex validation for set names (/^[a-z][a-z0-9-]*$/) and IDs (/^[A-Z][A-Z0-9-]*$/), but the resulting files are executed without further sandboxing.

jev-rules