The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses mise.toml to manage local development tasks such as linting, validation, and testing. These tasks execute local Python scripts (check_code_rules.py, check_evals.py, lint_writing.py, validate_skill.py) using the python3 command. This is standard behavior for developer-oriented tools and does not involve arbitrary or unsanitized shell execution.
[DATA_EXFILTRATION]: The skill instructions and scripts interact with local files to perform analysis and simplification. There is no evidence of network operations (curl, wget, requests) or attempts to transmit data to external servers.
[OBFUSCATION]: A minor string concatenation technique is used in scripts/check_code_rules.py (MARKERS = ("TO" + "DO", "FIX" + "ME", "XX" + "X")) to prevent the script's linter from flagging itself as a work marker. This is a common pattern in linting tools and is not malicious.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process other AI agent skills (Markdown and script files). While this represents a broad attack surface, the skill implements a strict 'Preservation Contract' requiring 1.0 ledger coverage, byte-exact protected spans (for commands, schemas, and hashes), and mandatory integrity checks using SHA-256 hashes to prevent unauthorized modifications or behavioral drift.

simplify-skill