The Agent Skills Directory

[DYNAMIC_EXECUTION]: The assets/examples/offline/harness.py script uses importlib.import_module and importlib.reload to dynamically load and refresh plugin modules (TodoLens.core, TodoLens.plugin) during offline testing and mutation verification. This is a standard practice for development environments requiring hot-reloading of local code.- [COMMAND_EXECUTION]: The assets/examples/offline/run_mutants.py and assets/examples/verify.sh scripts use subprocess.run and shell commands to execute test suites and verification tools. These operations are restricted to the local development environment and use the system Python interpreter.- [INDIRECT_PROMPT_INJECTION]: Evaluation files such as evals/files/NoteLens/note_lens.py demonstrate a vulnerability surface where untrusted buffer text is processed for display in HTML annotations without proper escaping. This is explicitly provided as a 'broken' case for educational and evaluation purposes, while the core skill instructions strictly mandate the use of html.escape() to prevent such injections.
Ingestion points: Buffer text read via view.substr() in note_lens.py and json_tidy.py.
Boundary markers: Absent in the vulnerable evaluation examples.
Capability inventory: The plugin system utilizes view.add_regions with HTML annotations, view.show_popup, and view.replace, which can be leveraged if content is not sanitized.
Sanitization: Absent in evaluation files, but enforced in the primary TodoLens example and instructions.- [EXTERNAL_DOWNLOADS]: Documentation in references/testing-and-packaging.md describes cloning the UnitTesting package from its official GitHub repository for host-based testing. This targets a well-known service and organization within the Sublime Text community and follows standard dependency management practices.

develop-sublime-text-plugins