The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill attempts to execute local scripts found within the project's .claude/scripts/ directory (e.g., precommit-runner.js and review-state.js). This behavior assumes the integrity of the project files and could lead to the execution of malicious code if the agent is used on an untrusted repository.
[COMMAND_EXECUTION]: The workflow involves running a wide variety of shell commands derived from project manifests across different ecosystems, including Node.js, Python, Rust, Go, Java, and Ruby. This includes commands like npm lint:fix, cargo test, and bundle exec rspec.
[EXTERNAL_DOWNLOADS]: The skill includes an "Auto-install attempt" branch when the runner script is missing. Although the specific implementation details are referenced from another skill (precommit-fast), this implies the dynamic fetching or creation of executable content from external sources.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted project data and manifest files to determine its execution path.
Ingestion points: Project configuration and manifest files including package.json, pyproject.toml, Cargo.toml, go.mod, build.gradle, pom.xml, and Gemfile, as well as the .claude/scripts/precommit-runner.js script.
Boundary markers: Absent. The instructions do not provide delimiters or specific guidance for the agent to ignore or sanitize embedded instructions within the project files it reads.
Capability inventory: The agent is granted extensive capabilities via the Bash tool to run builds, tests, and linting tools, and can read/search files using Read, Glob, and Grep.
Sanitization: Absent. Commands are constructed and executed directly based on the strings found in manifest files (e.g., executing scripts defined in package.json) without validation.

precommit