The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run throughout its scripts (quality.py, gate.py, stale-branches.py) to execute Git commands, GitHub CLI (gh) operations, and various project-specific build or test tools.
[DYNAMIC_EXECUTION]: The scripts/gate.py script dynamically loads and executes a Python module named review_boxes.py using importlib.util.spec_from_file_location. It searches for this file in the project's .agents/hooks/ directory, which allows project-local code to be executed when the skill is invoked. Additionally, it uses the GATE_QUALITY_SCRIPT environment variable to determine the path of its primary quality script.
[EXTERNAL_DOWNLOADS]: In scripts/quality.py, the Engines class can download and execute packages from the npm and PyPI registries using npx, uvx, or pipx if the required tools (e.g., knip, dependency-cruiser, lizard) are not pre-installed in the workspace. These downloads target well-known package registries.
[INDIRECT_PROMPT_INJECTION]: The skill parses untrusted data from project files and external sources: 1. Ingestion points: Reads AGENTS.md, masterplan.md, README.md, and GitHub issue/PR bodies (fetched via gh issue view). 2. Boundary markers: Lacks formal delimiters; relies on regex patterns like REACHES_LINE or keyword matching (e.g., Done when) to extract instructions. 3. Capability inventory: The extracted data influences shell command arguments, file path targets for analysis, and the inclusion of findings in PR reviews. 4. Sanitization: Employs a secret scanner (scan-secrets.py) before updating PR bodies and performs basic regex validation on test names in gate.py.

quality-checks