The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses !command`` syntax in SKILL.md to inspect the project environment at load time. Specifically, it checks for the existence of various lockfiles (pnpm-lock.yaml, yarn.lock, etc.) and the presence of a node_modules directory. While this executes shell commands silently when the skill is accessed, the operations are restricted to checking file existence and are benign developer-workflow utilities.
[COMMAND_EXECUTION]: The skill instructions and its reference file (references/rungs.md) contain numerous shell commands intended for execution by the agent. These include npm pack, tar, find, grep, jq, and gh api. The commands are standard tools for JavaScript development and repository management.
[SAFEGUARD_IMPLEMENTATION]: The skill explicitly mandates security best practices for remote content. It requires the use of the --ignore-scripts flag when running npm pack to prevent the execution of malicious lifecycle scripts from downloaded packages. It also instructs the agent to perform analysis in 'scratch' directories outside the main repository to prevent accidental pollution or execution within the project context.

read-source