The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's primary function is to generate executable Node.js (.js) and Shell (.sh) scripts at runtime. It assembles these scripts by interpolating variables extracted from the project environment (e.g., package manager names, script commands) into templates defined in references/templates.md.
[PRIVILEGE_ESCALATION]: Upon generating a non-Node runner script, the skill automatically executes chmod +x to make the file executable. This represents an automated elevation of permissions for dynamically created content.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project configuration files which can be manipulated to influence the generated script output.
Ingestion points: The skill reads package.json (scripts section), .claude/runner-config.json, pyproject.toml, and lock files.
Boundary markers: No explicit delimiters or warnings are used when interpolating external strings into the code templates.
Capability inventory: The skill uses the Write tool to persist the generated script to the file system and uses Bash to modify permissions and perform syntax verification.
Sanitization: There is no evidence of sanitization or escaping of the strings retrieved from manifest files before they are written into the executable templates.
[COMMAND_EXECUTION]: The skill performs a 'Basic syntax check' on the generated scripts. Depending on the implementation of the syntax check (e.g., running the script with a check flag), this could lead to the execution of code derived from the untrusted project manifest files.

generate-runner