The Agent Skills Directory

[DYNAMIC_EXECUTION]: The scripts/load_policy_contract.py script implements a feature to dynamically load Python code from a local path provided via the --heyeddi-ci-root parameter. It manipulates sys.path and uses a standard import statement to execute code from the app.policy_insights module within the user-specified directory. This creates a vector for arbitrary code execution if the provided path contains untrusted or malicious scripts.
[INDIRECT_PROMPT_INJECTION]: The skill is instructed to fetch a 'policy contract' from a remote API (https://cihook.heyeddi.com/api/public/eddi-ci-policy) and treats the returned fields—specifically guide, knobs, and rules—as authoritative instructions for generating configuration files. This dependency on external, unvalidated data creates an attack surface where a compromised response could inject malicious instructions into the agent's context.
Ingestion points: scripts/load_policy_contract.py fetches JSON data from the vendor's API.
Boundary markers: None present; the agent is explicitly told to treat the remote content as authoritative.
Capability inventory: The skill possesses file-system read capabilities (via inspect_repo.py) and file-system write capabilities (specified in SKILL.md for eddi-ci.yaml and .github/**).
Sanitization: No escaping or validation is performed on the remote content before it is processed by the agent.
[COMMAND_EXECUTION]: The library script scripts/_skill_cli.py includes a run_command helper function that utilizes subprocess.run to execute shell commands. Although this helper is not explicitly invoked by the tools currently defined in the manifest, the presence of a generic shell execution utility within the skill's codebase increases the overall attack surface and potential for misuse.

heyeddi-ci-config