The Agent Skills Directory

[DYNAMIC_EXECUTION]: The shared utility script scripts/check-lib.mjs includes an importPackage function that uses the dynamic import() statement with paths computed at runtime. This capability allows for loading and executing Node.js modules from the filesystem based on programmatically generated strings. Additionally, the skill's fixture assembly system used for self-testing involves complex dynamic file manipulations including writes, deletions, and symlink creation.
[INDIRECT_PROMPT_INJECTION]: The skill implements broad repository auditing in scripts/check-bypasses.mjs and scripts/check-gate-wiring.mjs. These scripts scan and process the content of nearly all source files in the repository using regular expressions to find gate suppressions (e.g., eslint-disable, @ts-ignore). This represents a vulnerability surface where content in a malicious file could attempt to influence agent behavior.
Ingestion points: The walkRepo function in scripts/check-lib.mjs is used to ingest data from files across the entire repository into the auditing logic.
Boundary markers: The auditing scripts do not use explicit delimiters or "ignore embedded instructions" warnings when presenting file contents or audit findings to the agent context.
Capability inventory: The skill possesses capabilities for subprocess execution (spawnSync, execSync, execFileSync) and arbitrary file system operations across the repository.
Sanitization: While the skill attempts to mask comments using the maskComments helper to avoid false positives, the core analysis logic acts on the potentially untrusted content of audited files.
[COMMAND_EXECUTION]: The skill's primary workflow relies on executing various developer tools (e.g., git, npm, eslint, jest, knip) via shell commands and subprocesses. While these operations are fundamental to the skill's purpose of quality enforcement, they involve high-privilege interaction with the host environment and external binaries.

quality-gates