The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/verified_red.py invokes subprocess.Popen with shell=True to run user-provided test commands. This is designed to support complex command lines involving pipes and redirections, but it grants the ability to execute arbitrary shell commands. The script contains explicit warnings in its docstring advising against running untrusted commands.\n- [INDIRECT_PROMPT_INJECTION]: The tool parses the output of executed test commands to differentiate between environment setup errors and valid test failures. This process involves reading potentially untrusted data from the command's output stream.\n
Ingestion points: The merged output from proc.communicate() in the run_test function in scripts/verified_red.py.\n
Boundary markers: None identified in scripts/verified_red.py; the script reads the entire combined stdout/stderr stream.\n
Capability inventory: The script performs file system operations (copying, directory creation), manages git worktrees, and executes shell commands in scripts/verified_red.py.\n
Sanitization: Employs regex matching (INFRASTRUCTURE_RED, TESTS_RAN) to categorize the output in scripts/verified_red.py, rather than executing the output itself.\n- [SAFE]: The scripts/verified_red.py script includes sophisticated path validation to prevent directory traversal attacks. It uses resolve() and is_relative_to() to ensure that all file operations are confined within the repository and the temporary worktree, specifically checking for and refusing to write through symlinks that point outside the worktree.

reproduce-then-fix