The Agent Skills Directory

[SAFE]: The skill performs a local audit of the repository's tooling and configurations. Analysis of the Python scripts (audit.py, generate.py, extract_conventions.py) shows they operate purely on local files within the audited repository and the skill's own directory. No network operations, data exfiltration, or access to sensitive system credentials (such as SSH keys or AWS credentials) were identified. The skill follows established patterns for developer tools and requires user approval before modifying project files.
[SAFE]: While the extract_conventions.py script parses untrusted data from CLAUDE.md and AGENTS.md, the risk of indirect prompt injection is mitigated by the use of re.escape() for generated patterns and the requirement for user review of all generated rules.
Ingestion points: Project documentation files CLAUDE.md and AGENTS.md are processed by extract_conventions.py to extract project-specific conventions.
Boundary markers: No explicit boundary markers are used during the parsing of these files.
Capability inventory: The skill uses Bash, Read, Write, Edit, Glob, and Grep tools to scan the file system and write configuration files.
Sanitization: Extracted terms are escaped using re.escape() before being included in generated regex patterns for the lint rules.

test-harness-auditor