The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/scan_hotspots.py uses subprocess.run to execute git commands for repository analysis, such as git diff and git ls-files. The implementation correctly uses a list of arguments rather than a shell string, which is a standard and safe practice for interfacing with local development tools.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted code from the user's repository, which presents a surface for indirect prompt injection via malicious code comments. The skill mitigates this risk by instructing the agent to treat the automated triage as preliminary and to demand concrete evidence (such as reachable callers or replacement diffs) for every finding, rather than relying solely on the code's appearance.
[DATA_EXPOSURE]: The tool reads repository files to identify complexity and specific markers. It employs secure file handling practices, including the use of O_NOFOLLOW flags and directory file descriptors to prevent symbolic link traversal and other file-system attacks during the analysis phase.
[EXTERNAL_DOWNLOADS]: The documentation in references/taxonomy.md includes references and links to reputable research from organizations like Google DeepMind, OpenAI, and Anthropic. These links are provided for educational context and do not involve runtime downloads or the execution of external code.

junk-detection