verify

The 'verify' skill is designed to provide a systematic quality check for software projects. It identifies the project type (Node.js, Rust, Go, or Python) and executes corresponding standard commands for building, testing, and auditing. 1. Command Execution: The skill uses the 'Bash' tool to run commands like 'npm run build', 'cargo test', and 'pytest'. While executing shell commands carries risk, these are standard development workflows and are restricted to the project's own defined scripts. 2. Indirect Prompt Injection: The skill reads local files and git diffs to identify debug statements, TODOs, and conflict markers. This creates a surface for indirect prompt injection where malicious instructions embedded in code comments could attempt to influence the agent's report or subsequent actions. Additionally, the metadata.json file contains a self-referential safety claim ('leakscan_ok: true'), which is a known pattern in Category 8. 3. Security Auditing: The skill proactively suggests running security audit tools (e.g., 'npm audit', 'pip-audit'), which is a positive security practice. 4. Data Handling: No evidence of data exfiltration or hardcoded credentials was found. The skill operates entirely on the local filesystem using 'Read', 'Grep', and 'Glob'.