The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module in several utility scripts (generate_review.py, run_eval.py, improve_description.py) to execute CLI tools such as claude, copilot, bash, and lsof. These are used for project-root discovery, running benchmarking loops, and managing local ports for a review server.
[DATA_EXFILTRATION]: The generate_review.py script starts a local HTTP server on 127.0.0.1 to provide a visual dashboard for reviewing evaluation results. This operation is limited to the loopback interface and is intended for local human-in-the-loop review.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and analyzes the contents of user-provided plugin files (markdown, JSON, and scripts). This is a known surface for any analysis-oriented skill, and the skill includes patterns (e.g., in references/patterns/) aimed at improving agent objectivity and robustness against such inputs.

audit-plugin