The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/load_policy_contract.py dynamically loads Python modules from local filesystem paths. It uses sys.path.insert(0, str(backend)) followed by from app.policy_insights import public_policy_contract. Because the backend path is derived from user-provided arguments (--heyeddi-ci-root) or environment variables (HEYEDDI_CI_ROOT), this behavior allows for arbitrary code execution if the targeted directory is compromised.
[COMMAND_EXECUTION]: The skill includes a utility script scripts/_skill_cli.py that contains a run_command function using subprocess.run. While this function is not actively invoked by the skill's primary tools, its presence in the codebase provides a latent capability for executing shell commands if the agent is instructed to use it.
[EXTERNAL_DOWNLOADS]: The skill fetches configuration and policy data from the author's official domain at https://cihook.heyeddi.com/api/public/eddi-ci-policy. This is standard functionality for retrieving the latest CI policy contract and is considered a trusted vendor resource.
[PROMPT_INJECTION]: The skill's instructions in SKILL.md and context/ANTI_PATTERNS.md use strong negative constraints (e.g., 'NEVER claim a job ran', 'Refuse execution claims') to ensure the agent adheres to the 'fail-closed' state of the runners. While intended for safety, these represent instructions aimed at overriding default agent behavior.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its data ingestion surfaces.
Ingestion points: The tool inspect_repo.py reads content from various repository files, including READMEs and configuration files. load_policy_contract.py ingests JSON data from an external API.
Boundary markers: No specific delimiters or safety warnings are implemented to separate untrusted repository content from instructions in the agent's context.
Capability inventory: The skill possesses capabilities for dynamic Python code execution and shell command execution (via subprocess.run in _skill_cli.py).
Sanitization: Ingested text is limited by length (20,000 characters), but no structural sanitization or escaping is applied to prevent embedded instructions from being interpreted by the agent.

heyeddi-ci-runners