The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes multiple utility scripts intended for use as agent hooks (e.g., python-ruff-check.mjs, secret-scan-adapter.mjs). These scripts execute local CLI tools such as git, ruff, gitleaks, and detect-secrets to perform validation and linting tasks.
Evidence in assets/hooks/python-ruff/scripts/python-ruff-check.mjs shows the use of spawnSync to invoke ruff check on Python files.
Evidence in assets/hooks/secret-scan-adapter/scripts/secret-scan-adapter.mjs shows the invocation of gitleaks or detect-secrets for security scanning.
Risk is mitigated by using argument arrays to prevent shell injection, performing path validation via fs.existsSync, and using the -- separator where applicable.
[SAFE]: The skill demonstrates high security awareness through its 'Risk gates' and 'Required reads' sections. It explicitly instructs the agent to defer high-risk actions (enabling hooks, installing MCP servers, or editing global config) until explicit user approval is granted. No data exfiltration, obfuscation, or malicious prompt injection patterns were found.

craft-harness