The Agent Skills Directory

[COMMAND_EXECUTION]: The verification script verify-env-docs.py utilizes subprocess.run to execute git commands (such as ls-tree and show). These operations are used to audit environment variable definitions across different git references (e.g., comparing a release tag to the current main branch). The execution uses argument lists to avoid shell injection and is scoped to local repository management.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the codebase, including .env.example files and Pydantic configuration files, which could theoretically contain malicious instructions. However, the script uses specific regular expressions to parse these files for structured data (variable names and default values) rather than passing raw text to the LLM's primary instruction flow, and the risk is considered low and inherent to the skill's purpose as a linter.
[SAFE]: The script includes proactive security measures such as is_placeholder, which explicitly identifies and ignores hardcoded example secrets (e.g., sk-9f73s) to ensure they are not mistakenly documented as valid default values. All identified external references target the project's own repository structure.

dify-docs-env-vars