The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fix.mjs utilizes execSync to perform operations involving ripgrep (rg) and git. The script interpolates the repository path (sourced from command-line arguments) and specific file names (sourced from the local filesystem) directly into shell strings. Specifically, lines like execSync(rg ... ${repo} ...) and execSync(git -C ${repo} mv "${from}" "${to}") do not sanitize these variables. A maliciously named file or a crafted repository path could allow for arbitrary command execution within the agent's environment.
[SAFE]: The skill manages dependencies and configuration for @howells/lint, which is identified as a vendor-provided resource belonging to the skill's author ('howells'). References to this package are consistent with the skill's primary purpose and do not represent a supply chain risk in this context.

howells-lint