The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes source code and git history from the local repository, which serves as a surface for indirect prompt injection if those files contain malicious instructions.\n
Ingestion points: Target source files and git history are read into the agent's context during the ACQUIRE scene of the Refactor Agent workflow.\n
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the interpolation of target code into the reasoning process.\n
Capability inventory: The skill possesses the capability to write to the filesystem, call external codemod tools, and execute the project's test suite via subprocess calls.\n
Sanitization: No explicit sanitization or filtering of the source code content is described before it is processed by the agent.- [COMMAND_EXECUTION]: The skill executes shell commands to analyze git history and measure code complexity.\n
Evidence: The resources/hotspots.py script uses subprocess.run to call git log, git diff-tree, and the lizard tool.\n
Safeguards: Command execution is performed using list-based arguments rather than shell strings, avoiding shell interpolation risks. Additionally, the measure function in hotspots.py validates that the target file path is within the repository root using is_relative_to before execution.- [EXTERNAL_DOWNLOADS]: The documentation mentions the use of uvx for running the lizard complexity tool, which may involve fetching the package from a remote registry.\n
Evidence: resources/measurement.md suggests using uvx lizard to run the tool.\n
Context: The usage targets a well-known tool (lizard) via a standard package runner (uvx) from a trusted registry (PyPI), which constitutes a safe developer workflow. The skill's own implementation in hotspots.py checks for the tool's presence locally rather than automatically downloading it.

oma-refactor