The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts and standard Git commands (e.g., git diff, git rev-parse) using the subprocess module. The execution uses safe argument lists rather than shell strings, mitigating the risk of command injection. The skill also generates and opens a local HTML report using system utilities.\n- [EXTERNAL_DOWNLOADS]: The HTML template references the Prism.js syntax highlighting library from a well-known and trusted CDN (cdnjs.cloudflare.com). This is a standard practice for developer visualization tools and does not introduce external code execution risks in the agent's environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository (code diffs). \n
Ingestion points: The understand.py script reads the output of git diff and repository files into a structured data.json. \n
Boundary markers: The instructions require the agent to manually review each hunk and file to verify intent, providing a human-in-the-loop or cognitive boundary. \n
Capability inventory: The skill's capabilities are limited to reading repository metadata and creating local HTML reports. \n
Sanitization: The HTML template uses an esc() function to escape HTML special characters for all data interpolated into the interface, protecting the viewer from potential scripts embedded in the repository code.

understand