The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a PostToolUse hook designed to run the mypy static type checker after a Python file is edited. The hook executes the command bash -c '... python -m mypy ... "$TOOL_INPUT_FILE_PATH" ...'. The use of $TOOL_INPUT_FILE_PATH within a shell-executed string, even though enclosed in double quotes, presents a theoretical surface for command injection if the environment variable contains malicious shell metacharacters and is not sanitized by the platform.
[PROMPT_INJECTION]: The skill is subject to a surface for indirect prompt injection via the local project's file structure.
Ingestion points: The skill processes file paths (specifically $TOOL_INPUT_FILE_PATH) provided by the agent's internal tooling context after editing a file.
Boundary markers: The file path variable is enclosed in double quotes within the shell command string, providing minimal protection against adversarial shell payloads.
Capability inventory: The skill possesses the capability to execute shell commands using bash -c and to run the mypy Python module.
Sanitization: No explicit sanitization, character escaping, or path validation is performed on the input variable before it is incorporated into the shell command.

fastapi-workflow