The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a script run-checks.mjs designed to execute shell commands specified in an adoption plan JSON. This capability is guarded by multiple layers of security:
Commands must be explicitly approved in the JSON file (approved: true).
The entire plan file is hashed (sha256), and the script requires the user to provide this digest at execution time (--approve <digest>). This prevents 'bait-and-switch' attacks where a plan is modified after review.
Commands are executed via execFileSync with shell: false, significantly reducing the risk of shell injection.
The command string itself is validated to exclude shell metacharacters and whitespace.
Standard output and error streams are ignored (stdio: 'ignore') to prevent the accidental leakage of credentials or tokens into logs or the agent context.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted repository data and user-provided JSON plans. It manages this risk surface effectively:
Ingestion Points: inspect-repo.mjs reads directory entries and filenames; validate-plan.mjs and run-checks.mjs read external JSON plan files.
Boundary Markers: The scripts use strict JSON schema validation (Version 1.0.0) and structured data instead of free-text parsing.
Capability Inventory: Capabilities include file writing (preview-sample.mjs) and command execution (run-checks.mjs).
Sanitization: All file paths are resolved to their realpaths and checked for root escape via a dedicated isWithinRoot utility that handles symlinks and .. traversals. Command arguments are restricted to strings, and shell metacharacters are rejected in the executable path.
[SAFE]: The skill uses zero external dependencies (Node.js standard library only), reducing supply chain risks. It also includes extensive documentation and regression tests that explicitly verify the security boundaries and safety rules stated in the reference material.

make