The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands such as nix build, nix flake check, and just lint. Running these commands relies on the integrity of the project's configuration files; if the repository contains malicious instructions in flake.nix or justfile, the agent will execute them during the scan.
[EXTERNAL_DOWNLOADS]: The instructions require the agent to 'RESEARCH the best golang code duplication finder before you implement it'. This encourages the agent to download and run unverified third-party tools or libraries from external sources.
[COMMAND_EXECUTION]: The skill directs the agent to modify the project's justfile by adding a new 'find-duplicates' command and alias, which involves automated modification of local configuration files.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8):
Ingestion points: Reads and executes logic from flake.nix, justfile, and other project-specific build configuration files in the working directory.
Boundary markers: None identified; the agent is not instructed to ignore embedded instructions in the build scripts.
Capability inventory: Full shell command execution via build tools and file-write capabilities (modifying justfile).
Sanitization: None identified; the skill directly interpolates project-defined build systems into its execution process.

code-quality-scan