The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/run-triad-review.mjs script uses node:child_process (spawn) to execute external reviewer commands. It includes flags designed to bypass user confirmation: --permission-mode dontAsk for Claude, --permission-mode dont_ask for QoderCLI, and --trust for Cursor's Agent. This allows the skill to execute tools and potentially perform actions without the user's explicit approval for each operation.
[COMMAND_EXECUTION]: The parseArgs function in scripts/run-triad-review.mjs takes command-line arguments like --target and --cwd and passes them directly to path.resolve and then into command arguments for spawn. While spawn is generally safer than exec, the combination of bypassed permissions and directory-scoping arguments from a user-influenced environment can lead to unexpected command execution behaviors.
[EXTERNAL_DOWNLOADS]: The skill depends on several external CLI tools (claude, qodercli, agent, codex) being present in the environment. While these are presented as architecture reviewers, the skill triggers their execution automatically. Specifically, qodercli is a tool related to the skill's author (QoderAI), representing a vendor-specific resource.

triangulate-spec-review