The Agent Skills Directory

[COMMAND_EXECUTION]: The verify.sh and time-to-first-commit.sh scripts use the shell eval command to execute strings detected from the target repository's environment (e.g., bootstrap and test scripts). This dynamic execution occurs without sanitization of the command string.
[REMOTE_CODE_EXECUTION]: During the verification phase, the skill executes code found within the repository it is auditing. This creates a direct path for arbitrary code execution if an agent is directed to audit a malicious or untrusted repository.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from the repository's git history and manifest files.
Ingestion points: scripts/audit.sh (git logs), scripts/lib/detectors.sh (manifest files like package.json, Justfile, Makefile).
Boundary markers: None; the skill parses free-form text from commit messages and configuration data without isolation or strict schema validation.
Capability inventory: File system writes (scaffolding), shell command execution (eval in verification scripts), and local environment interaction.
Sanitization: While safe_expand in scripts/lib/common.sh sanitizes internal configuration variables, the skill lacks sanitization for external data ingested from the target repository before it influences script generation or execution.
[SAFE]: The skill correctly implements a 'scaffold-to-scratch' pattern, ensuring that all generated files are placed in a temporary directory for user review before being applied to the working tree. Additionally, it provides clear safety checks to prevent running destructive operations (like reset.sh) against production environments.

dx-harness