The Agent Skills Directory

[COMMAND_EXECUTION]: The instructions in SKILL.md interpolate positional arguments directly into shell commands (e.g., uv run ruff check ${1:-.}, npm run lint ${1:-.}). Because these variables are not escaped or sanitized, an attacker providing a path containing shell metacharacters (e.g., ; rm -rf /) could achieve arbitrary command execution.
[COMMAND_EXECUTION]: The helper script detect-and-fix.sh uses eval "$cmd" to execute linter commands. While the commands themselves are largely hardcoded within the script, using eval to process strings in an environment where the working directory is controlled by user-supplied arguments is a risky execution pattern.
[SAFE]: The skill utilizes dynamic context injection (commands starting with !) in the YAML frontmatter to detect project files. The specific commands used (find . -maxdepth 1 ...) are benign and standard for identifying project structures like package.json or Cargo.toml.

code-lint