The Agent Skills Directory

[COMMAND_EXECUTION]: The test suite (tests/test_promise_contract.py) uses subprocess.run to invoke the bundled promise-contract.py script. This usage is confined to unit testing the local CLI tool with controlled arguments and does not pose a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external manifest files. The analysis of scripts/promise-contract.py shows that it performs structural linting and schema validation using regex and string parsing, rather than executing or evaluating the content as code, effectively mitigating injection risks.
[DYNAMIC_EXECUTION]: The bundled Python script implements a restricted YAML parser that avoids unsafe deserialization methods. It uses json.loads() specifically for string literals and does not employ eval() or other dangerous functions.

promise-theory