The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts loc_counter.py and git_session_analyzer.py utilize the Python subprocess module to execute git commands such as ls-files, diff, log, and show. These executions are central to the skill's primary purpose of measuring code scope and development history. The scripts use list-based arguments without a shell environment (shell=False), which effectively prevents standard shell command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading file paths and contents from the repository being analyzed within loc_counter.py. To mitigate injection risks, the skill operates within a restricted fork context and adheres to a structured reporting contract defined in references/report-contract.md. Its capabilities are limited to local git operations, and it lacks network access or file-write capabilities that could be abused. The scripts also use robust file-reading practices, such as the errors="replace" flag, and focus on quantitative metrics rather than semantic interpretation of the analyzed code.

cost-estimate