The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a wide range of standard development tools and repository-defined scripts (e.g., npm test, pytest, mvn verify, cargo build). While these are standard for quality assurance, they represent a capability to execute arbitrary code defined within the repository's manifest files.
[DATA_EXFILTRATION]: The skill explicitly includes the .env file in its fingerprinting process to determine cache freshness. While used for integrity checks, this involves accessing a sensitive file path containing potential secrets. The skill also interacts with network-based services like Sonar for static analysis.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an automated auditor for repository content, creating a surface where malicious code or instructions within the repository could influence agent behavior or take advantage of the skill's execution capabilities.
Ingestion points: Project source code, manifest files, and test suites throughout the repository (e.g., package.json, pyproject.toml, .env).
Boundary markers: None provided to delimit project content from agent instructions.
Capability inventory: Execution of project scripts via subprocess, execution of build tools, and writing of audit reports and cache files.
Sanitization: The skill does not describe specific sanitization of tool outputs or repository scripts before processing or execution.
[DYNAMIC_EXECUTION]: The skill utilizes runtime compilation and build tools (e.g., tsc, mvn package, cargo build, go build) to validate the project. While this is the intended purpose of the skill, it involves compiling and executing code from the target repository.

quality-check