The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a utility function exec_command in scripts/mechanical_refactor_reproduction_utils.py that uses subprocess.run with shell=True. This function executes various Git commands by interpolating variables like branch names and commit hashes directly into shell strings. While shlex.quote is applied to commit messages, other parameters lack consistent sanitization, increasing the risk of command injection.
[REMOTE_CODE_EXECUTION]: The verify command in SKILL.md, implemented via scripts/mechanical_refactor_reproduction_cli.py, automatically executes Python scripts located in a directory specified by the user. The skill's documentation specifically encourages users to download these "proof folders" from external PRs or GitHub Gists, creating a direct path for executing unvetted code from potentially untrusted sources.
[DYNAMIC_EXECUTION]: The core functionality of the skill involves scripts/mechanical_refactor_proof_generator.py programmatically generating Python source code, which is then saved to disk and executed at runtime. This practice of dynamic code generation and execution is a high-privilege operation that requires strict trust in the input data (git history and diffs).
[INDIRECT_PROMPT_INJECTION]: The skill relies on parsing untrusted external data, including Git commit messages and repository diffs, to classify commits and drive its logic. Commit messages are checked for specific keywords (mechanical_provable) that trigger high-privilege actions, providing a surface where a malicious contributor could attempt to influence the agent's behavior or bypass verification steps.

mechanical-refactor-verify