The Agent Skills Directory

[COMMAND_EXECUTION]: The install.py script and the adapters/opencode.js file execute shell commands using python3 to run linting hooks, perform self-tests, and synchronize configuration changes across supported agent platforms.
[DYNAMIC_EXECUTION]: The skill utilizes dynamic execution patterns to load and run its components. hooks/comment-lint.py uses importlib.util to execute another script (commit-pr-lint.py) at runtime. Additionally, hooks/response-lint.py dynamically locates and imports a separate plugin module (metrics_v2) by modifying sys.path based on the contents of the agent's plugin registry file located at ~/.claude/plugins/installed_plugins.json.
[PERSISTENCE]: The install.py script establishes persistence by modifying global agent configuration files, such as ~/.claude/settings.json, ~/.codex/hooks.json, and ~/.config/opencode/opencode.json. These modifications register the skill's scripts as hooks that automatically trigger during various agent events, such as before tool execution or after a response is generated.
[PRIVILEGE_ESCALATION]: The installation process involves modifying high-level agent settings and creating symlinks within the user's home directory (e.g., ~/.claude/rules, ~/.claude/skills). This allows the skill to influence the agent's global behavior and processing logic across different projects and sessions by injecting its own rules and scripts into the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as code comments, commit messages, and conversation transcripts. Ingestion points include sys.stdin, the transcript_path file, and tool_input fields. While strip_protected removes backticks to prevent some accidental command execution, there are no robust boundary markers when the skill reflects violations back to the agent in the reason field. The skill possesses significant capabilities, including executing shell commands via spawnSync and modifying agent configuration files, making the lack of full sanitization of reflected content a potential vulnerability.

tone-fix