The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes system commands to facilitate the build process, specifically utilizing Git and the OpenHarmony hb utility.
Evidence: The script scripts/helper.py uses subprocess.run to execute git status for detecting local changes and hb build for compilation. These calls use list-based arguments, ensuring that shell injection is not possible even if file paths were maliciously crafted.
[INDIRECT_PROMPT_INJECTION]: The skill processes environmental data that could potentially be influenced by an attacker, such as filenames in a Git repository or compiler error messages.
Ingestion points: scripts/helper.py ingests filenames from the output of git status --short and parses strings from compiler stdout/stderr.
Capability inventory: The script can trigger the hb build process for specified targets.
Boundary markers: No explicit delimiters or boundary markers are employed when processing command output.
Sanitization: Filenames are validated against a hardcoded prefix map (FILE_TARGET_MAP) before being used to infer build targets, which effectively restricts the execution surface to known project services.

hb-build