The Agent Skills Directory

[COMMAND_EXECUTION]: The validation script scripts/test_assets.py uses the subprocess module to execute the local assets/shared/observe.py script. This is a contained operation used solely for verifying that configuration fixtures provided within the skill are correctly handled by the observer handler.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to manage and modify agent configuration files like .claude/settings.json and hooks.json. It mitigates potential risks from untrusted data by requiring explicit invocation, providing a harmless observer script for testing, and instructing the user to perform manual security reviews of all hook commands and inherited environments.
[SAFE]: The documentation provides robust security guidance, advising users to audit inherited secrets, verify shell quoting, and treat hook files as executable trust boundaries. The skill also explicitly disables implicit invocation to ensure it only runs when intended.

manage-agent-hooks