The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/iar_builder.py to invoke the iarbuild.exe compiler. This is the primary purpose of the skill. The command is executed using a list of arguments rather than a shell string, which is a secure practice that prevents shell injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project files (.ewp) from the user's workspace to identify build configurations and output paths.
Ingestion points: The parse_project function in scripts/iar_builder.py parses XML data from files detected in the workspace.
Boundary markers: The script does not use explicit boundary markers to delimit data extracted from these files when reporting results back to the agent.
Capability inventory: The script has capabilities to read files, search directories, and execute the IAR build tool.
Sanitization: While the script uses safe subprocess invocation, it does not explicitly sanitize or validate the content of the XML project files before using extracted strings (like configuration names) in its internal logic and output.

build-iar