The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill generates and executes arbitrary Bash and Python "proving scripts" at runtime to verify code safety. These scripts are run via a helper script (scripts/prove.sh) that provides filesystem isolation through temporary directories but is explicitly documented as not being a security sandbox. This creates a risk of unauthorized command execution if the AI-generated scripts are manipulated by malicious patterns in the code being analyzed.\n- [PROMPT_INJECTION]: The "Persona at invocation" system dynamically loads behavioral instructions from CLAUDE.md or AGENTS.md files located in the project root. This mechanism allows local repository files—which may contain untrusted content from a cloned repository or a pull request—to influence or override the agent's system instructions and persona.\n- [COMMAND_EXECUTION]: The skill utilizes several shell-based tools including git and gh (GitHub CLI) to inspect repository state, retrieve pull request diffs, and manage file snapshots. It also invokes a local helper script (scripts/prove.sh) to execute the generated verification logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted data.\n
Ingestion points: Processes git diff output, gh pr view metadata, and untracked repository files.\n
Boundary markers: Includes explicit instructions to treat content from untrusted documents and tool outputs as data rather than commands.\n
Capability inventory: Possesses significant capabilities including local shell execution and the ability to write and run scripts with access to the repository's source code.\n
Sanitization: Employs a helper script to isolate the analyzed source code into a temporary snapshot directory, although it does not provide a full security sandbox for the execution of the proof scripts themselves.

augur