The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data including GitHub pull request metadata, repository source code, and evaluator reports (NDJSON). It employs multiple layers of validation to mitigate risks from untrusted data, such as the validate-parity-input.jq filter and the validateRepository function in scripts/compare-parity.mjs, which checks for unsafe shell characters in directory paths.
Ingestion points: Data enters the system via gh pr view output and local reads of NDJSON/JSON artifacts generated by the evaluator.
Boundary markers: Uses strict JSON and NDJSON schema validation to ensure data integrity.
Capability inventory: Executes git via execFileSync, runs local node scripts via spawnSync, and performs local file system operations.
Sanitization: Validates GitHub owner/repository patterns, enforces 40-character hex strings for commit hashes, and rejects root directory paths containing shell metacharacters.
[COMMAND_EXECUTION]: The skill executes git and node subprocesses to analyze code changes and compare results. These are handled using execFileSync and spawnSync with argument arrays rather than shell strings, following security best practices to prevent command injection.
[EXTERNAL_DOWNLOADS]: The skill interacts with GitHub (a well-known service) to fetch pull request details and repository content. These operations are performed using the authenticated gh CLI and standard git commands, which are appropriate for the skill's stated purpose as a development utility.

run-parity