The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by scanning untrusted project files and executing build commands based on that context.\n
Ingestion points: scripts/quality_checker.py and multiple Go-specific scanners (e.g., scripts/check-errors.sh) iterate through the local project source files and repository configuration.\n
Boundary markers: Absent. There are no delimiters or specific instructions to treat project data as untrusted or to ignore instructions embedded in source code or Makefiles.\n
Capability inventory: scripts/quality_checker.py executes make check using subprocess.run. Other scripts use standard utilities like find, grep, and sed on file contents.\n
Sanitization: Absent. The skill assumes the project environment and its Makefile are trustworthy.\n- [COMMAND_EXECUTION]: The skill executes shell commands as part of its intended functionality.\n
Evidence: scripts/quality_checker.py uses subprocess.run(["fish", "-c", "make check"]) to trigger the local project's test suite. While expected for a developer tool, this allows the execution of any commands defined in the project's Makefile.\n- [EXTERNAL_DOWNLOADS]: scripts/sync-google-style-guide.py retrieves content from a remote repository.\n
Evidence: It uses urllib.request.urlopen to download style guide documents from the google/styleguide GitHub organization. This is a trusted organization and the retrieved files are documentation (.md).\n- [DYNAMIC_EXECUTION]: The skill generates code dynamically at runtime.\n
Evidence: scripts/gen-table-test.sh uses shell templates to generate Go table-driven test scaffolds. This is a low-risk behavior using static templates.

programming