The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script scripts/inspect-cargo.py that executes the cargo metadata command locally to gather information about the Rust project structure. This execution is performed using safe subprocess patterns without a shell, specifically using a list of arguments and the --offline flag to prevent network side effects.
[EXTERNAL_DOWNLOADS]: The documentation guides the user to install the gobley-uniffi-bindgen tool via cargo install and use specific Gradle plugins (dev.gobley.cargo, dev.gobley.uniffi) from Maven Central. These actions are transparent and necessary for the skill's functionality as a developer tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes local configuration files (Cargo.toml), which constitutes an attack surface for indirect instructions through tool output.
Ingestion points: User-provided path to Cargo.toml is processed by scripts/inspect-cargo.py.
Boundary markers: The inspection script uses --no-deps and --offline flags with the cargo command to isolate the operation from the network and external dependencies.
Capability inventory: The script executes cargo commands and processes JSON output to validate project configurations across ALL scripts.
Sanitization: Input paths are validated as files, and command arguments are passed as a list to the subprocess module to prevent command injection.

gobley