The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script scripts/lint.py executes the ruff linter using subprocess.run. The implementation follows security best practices by passing arguments as a list and avoiding the use of a shell, which prevents command injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the ruff linter and the requests library. These are well-known and trusted tools within the Python development community.\n- [PROMPT_INJECTION]: The skill's code review functionality (Mode 1) ingests untrusted code, representing an indirect prompt injection surface.\n
Ingestion points: User-provided source code processed during the review phase in SKILL.md.\n
Boundary markers: None explicitly defined to separate reviewed code from agent instructions.\n
Capability inventory: Subprocess execution via scripts/lint.py and standard file system access.\n
Sanitization: None; code is read directly into the context.\n
Assessment: While an ingestion surface exists, the risk is mitigated by the skill's highly structured instructions for code analysis and reporting, which provide a robust behavioral framework for the agent.

effective-python