The Agent Skills Directory

[COMMAND_EXECUTION]: The inventory scripts for Rust, Dart, and Python (languages/*/inventory.py) utilize subprocess.run() to execute git ls-files. This is a standard operation for developer tools to identify source files within a repository and does not pose a security risk in this context.
[COMMAND_EXECUTION]: The TypeScript inventory script (languages/typescript/inventory.mjs) uses node:child_process execSync to run git ls-files for the same purpose of file discovery.
[DYNAMIC_EXECUTION]: The TypeScript inventory script (languages/typescript/inventory.mjs) dynamically loads the typescript package from the target repository's node_modules using createRequire. This is intended behavior to ensure the tool uses the same compiler version as the project being analyzed.
[DATA_EXFILTRATION]: No evidence of unauthorized data transmission or access to sensitive credentials was found. The scripts perform local static analysis of code symbols and report them to standard output for the user's planning purposes.

decision-free-specs