The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/sync_skill_repo.py makes extensive use of the subprocess module to execute system commands including git, node, pnpm, and uv for repository synchronization, folder hashing, and running tests. These commands use argument lists to prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill uses pnpm dlx to download and execute the skills CLI tool from a remote package registry. This is part of the intended installation and update mechanism for the skill's synchronization backend.
[REMOTE_CODE_EXECUTION]: Through the use of pnpm dlx, the skill downloads and executes code at runtime. This behavior is essential for its primary function of managing skill deployments and is protected by restricted environment configurations.
[DYNAMIC_EXECUTION]: The skill executes a hardcoded Node.js script via node -e to calculate directory hashes for integrity verification and uses uv run --script to execute test runners within skill directories.
[DATA_EXFILTRATION]: The skill publishes code changes to remote GitHub repositories via git push. This functionality is restricted to GitHub upstreams and explicitly excludes sensitive data such as .git metadata, node_modules, and .env files from being synchronized.

sync-skill-repo