The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides installation commands for missing dependencies using pnpm dlx. However, these commands are formatted as informational guidance for the user rather than automated execution by the agent. Crucially, the commands include npm_config_ignore_scripts=true, which is a security best practice to prevent arbitrary script execution during package installation.
[REMOTE_CODE_EXECUTION]: The skill references external dependencies from the patinaproject and mattpocock GitHub organizations. These are well-known, established sources in the ecosystem, and the references are used for standard skill installation rather than dynamic runtime execution of untrusted code. As these are trusted/well-known services, this does not escalate the verdict.
[PRIVILEGE_ESCALATION]: No privilege escalation patterns (like sudo or chmod) were detected.
[DATA_EXFILTRATION]: No network exfiltration or sensitive file access patterns were detected. The skill operates within the scope of a standard git/PR workflow.
[PROMPT_INJECTION]: No malicious override or bypass instructions were detected. The skill contains standard instructional language about task priority (e.g., 'instructions win' over issue bodies), which is a functional requirement for its controller role.

develop