The Agent Skills Directory

[Command Execution] (SAFE): The scripts/lint_runner.py script executes subprocesses to run linters like ruff, mypy, and eslint. All command strings are hardcoded or derived from standard project triggers. On Windows, it correctly handles command execution for .cmd files. This is standard and expected behavior for a developer tool.
[Data Exposure & Exfiltration] (SAFE): The skill reads local project files for static analysis and linting. No network operations, hardcoded credentials, or access to sensitive system paths (e.g., SSH keys) were detected.
[Indirect Prompt Injection] (LOW): The skill possesses a surface for indirect prompt injection because it executes scripts defined in the target project's configuration files (e.g., npm run lint from package.json).
Ingestion points: package.json and pyproject.toml in the project being analyzed.
Boundary markers: Absent; the agent is instructed to run these tools directly on project contents.
Capability inventory: subprocess.run calls within scripts/lint_runner.py capable of executing project-defined scripts.
Sanitization: None; the skill is designed to execute the project's own defined quality control scripts.

lint-and-validate