The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently executes shell commands via execFileSync, including git (for worktree management, diffing, and history inspection), gh (to retrieve authentication tokens and repository defaults), and npm (to install dependencies in a temporary worktree).
[REMOTE_CODE_EXECUTION]: In body-links.mjs, the skill executes a binary located at .repo-standards/runtime/node_modules/.bin/repo-standards within the repository being processed. Although it runs npm ci with the --ignore-scripts flag, the subsequent execution of this tool from the pull request's head commit allows for the potential execution of code controlled by the PR author during the link verification process.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from pull request bodies and comments to determine its internal state and whether to proceed with merging or requesting further reviews.
Ingestion points: Pull request body content (pull.body) and conversation comments (comments).
Boundary markers: The logic relies on specific markers such as reviewer.finished.commentMarker and externalReviewSentence to identify valid state transitions.
Capability inventory: Includes shell command execution (git, gh, npm), file system operations (worktrees, temporary directories), and execution of repository-supplied binaries.
Sanitization: Implements author verification, ensuring review-related comments originate from the designated reviewer account. It also utilizes the marked and parse5 libraries to parse pull request content structurally rather than relying on raw string matching.
[CREDENTIALS_UNSAFE]: The platform.mjs script executes gh auth token to retrieve the current user's GitHub authentication token. While this is used to interact with the GitHub API via the postern library, the retrieval and presence of the token in the script's execution environment is a sensitive operation.
[DYNAMIC_EXECUTION]: The skill dynamically installs and then executes a tool (repo-standards) from a local path inside the repository being analyzed to verify compliance with repository standards.
[EXTERNAL_DOWNLOADS]: The skill executes npm ci to install dependencies for the Repository Standards runtime, which involves downloading packages from the npm registry to a temporary directory.

babysit