The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on system commands such as ps, lsof, git, and tmux to gather runtime telemetry and resource counts. This execution is performed via platform adapters and is essential for the stated purpose of auditing application performance.
[DATA_EXPOSURE]: The skill interacts with local application data, including process trees and SQLite databases. Security risks are mitigated by the profile_store.py script, which contains a blacklist of sensitive segments (e.g., 'token', 'secret', 'password', 'credential', 'api_key') to prevent them from being persisted in the user profile. Additionally, the instructions explicitly mandate masking credentials and private data during reporting.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted application telemetry and structured evidence JSON files. While this represents an attack surface, the processing is managed by deterministic Python logic with strict schema validation. The workflow also mandates human verification of findings and 'fail-closed' policies to ensure resources are protected if evidence is malformed or ambiguous.
[DYNAMIC_EXECUTION]: A finding was flagged by the AST analyzer regarding subprocess.run in tests/test_evidence_report.py. This call is used exclusively within the test suite to execute the skill's own reporting script for validation purposes and does not pose a risk from untrusted user input.

lov-app-optimizer