The Agent Skills Directory

[SAFE]: The skill is designed for high-integrity diagnostic comparison and performance benchmarking within a React development environment. It follows best practices for handling external data and sensitive credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub pull requests and NDJSON reports generated by Vercel Sandbox.
Ingestion points: Data enters through gh pr view output and multiple NDJSON files (baseline.ndjson, candidate.ndjson).
Boundary markers: The skill uses strict JSON and NDJSON schema validation throughout its scripts to ensure records match expected structures.
Capability inventory: Capabilities include file system operations, GitHub CLI usage, and internal evaluation tools (nr eval).
Sanitization: Input is filtered through validate-parity-input.jq and validated by Node.js scripts using SHA-256 hashes and canonical serialization before any comparison occurs.
[COMMAND_EXECUTION]: The skill executes several local Node.js scripts for analysis and verification. A review of these scripts (e.g., find-impacted-rules.mjs, compare-parity.mjs) shows that subprocess calls to git use execFileSync with pinned 40-character commit hashes and controlled arguments, preventing shell injection.
[DATA_EXFILTRATION]: The skill requires Vercel authentication tokens. These are used exclusively by the project's standard evaluation tools and are not hardcoded or transmitted to unverified external domains.
[DYNAMIC_EXECUTION]: The skill uses the TypeScript compiler API for static analysis of code changes to determine rule impact. This is performed safely within the find-impacted-rules.mjs script and does not involve executing untrusted code.

run-parity