The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/static_analyzer.py uses subprocess.run() to execute local binaries including cppcheck, clang-tidy, and gcc. This is the primary and intended function of the skill to perform static code analysis. The implementation uses list-based arguments rather than shell strings, which is a secure practice to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external source code and project configuration files (compile_commands.json), which represents an indirect prompt injection surface.
Ingestion points: Reads files from user-specified directories and processes compile_commands.json in scripts/static_analyzer.py.
Boundary markers: None present; the skill treats the tool output as data to be parsed and reported.
Capability inventory: File system enumeration, file reading, and execution of static analysis tools via subprocess.
Sanitization: The script uses regular expressions and the xml.etree.ElementTree library to parse tool output, providing structured data to the agent context.

static-analysis