The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/check-analytics-behaviour.mjs utilizes a custom module loader hook defined in scripts/lib/app-modules.mjs to dynamically load and execute TypeScript modules from the repository being analyzed. This occurs via import() calls to verify that the app's analytics gate and sanitizer behave as expected. If the audited files (e.g., create-analytics.ts) contain side-effecting code, it will be executed within the analysis process.
[COMMAND_EXECUTION]: The scripts/selftest.mjs script and the runNode helper in scripts/check-lib.mjs use spawnSync to execute Node.js scripts. This is used for internal self-testing of the skill's own checkers against test fixtures.
[INDIRECT_PROMPT_INJECTION]: The skill's analysis scripts (check-analytics.mjs) ingest and process untrusted codebase content using regular expressions and a custom TypeScript literal parser (scripts/lib/ts-literal.mjs). This constitutes a vulnerability surface where crafted code content could attempt to influence the analysis outcome or bypass checks, although the checkers use a reasonably robust multi-layered approach.

analytics-and-consent