The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses child_process.spawnSync in references/qa-execute-snippets.mjs to dual-shell execute (bash and zsh) code snippets extracted from markdown files. This is the primary purpose of the skill (validation of documented commands). The risk is mitigated by a sophisticated lexical classifier that implements a default-deny policy for dangerous commands and redirections.
[DYNAMIC_EXECUTION]: The skill loads and executes ES modules and shell functions from the repository at runtime to verify security controls. These operations are confined within an isolated environment using sandboxEnv (in references/qa-execute-snippets.mjs), which strips credentials and sensitive variables, and uses a directory snapshotting technique to detect unauthorized file system writes outside the sandbox.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from work items and repository source code (Ingestion points: SKILL.md). The attack surface is bounded because the agent only generates a probe specification, not the final verdict (Boundary markers: references/security-review-prompt.md). While the tool has subprocess and code execution capabilities (Capability inventory: references/qa-execute-snippets.mjs), it uses a deterministic engine with deep lexical sanitization and command allow-listing (Sanitization: references/qa-execute-snippets.mjs).

review-security