The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/run-fx-review.mjs programmatically retrieves sensitive credentials from the macOS Keychain using the /usr/bin/security utility. Specifically, it fetches the password for the Vercel AI Gateway service (vercel-ai-gateway account). While the script includes logic to redact this key from generated artifacts and logs, the automated extraction and transmission of host-level secrets to sub-processes represents a high-severity credential handling risk.
[DYNAMIC_EXECUTION]: The utility scripts/validate-run-report.mjs uses the Function constructor to execute arbitrary JavaScript code passed as a string via the expression argument. This capability is used by the test suite in scripts/test-report-gate.sh to dynamically mutate JSON report fixtures during execution.
[COMMAND_EXECUTION]: The skill makes extensive use of spawnSync and execFileSync to execute shell scripts and local binaries, including git, bun, and the fx model runner, to perform its gating and review functions.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data, including git diffs and PR descriptions, which creates an attack surface for indirect prompt injection. Malicious instructions embedded in the code under review could potentially influence the agent's behavior during the gating process.
Ingestion points: scripts/gate.sh reads content from git diffs and PR body Markdown files (e.g., evals/fixtures/prbody/2135-original.md).
Boundary markers: The skill uses structured manifest profiles and lenses to scope its review, but it lacks explicit prompt-level delimiters to neutralize embedded instructions in the reviewed content.
Capability inventory: The skill can execute shell commands, read/write files in the repository, and access system keychain credentials.
Sanitization: The scripts/run-fx-review.mjs script implements redaction to prevent the AI_GATEWAY_API_KEY from appearing in generated report artifacts.

gate