The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill is highly vulnerable to indirect prompt injection through the processing of untrusted local or remote code repositories.
Ingestion points: scripts/check_quality.py and scripts/autofix.py take a target_directory as an argument and process all files within that tree.
Boundary markers: No delimiters or safety instructions are provided to the underlying tools to prevent the execution of instructions embedded in the source code or comments.
Capability inventory: The skill invokes pytest via subprocess.run in check_quality.py. By design, pytest executes any Python code found in test files (e.g., test_*.py). This allows an attacker to execute arbitrary code on the host system if the agent runs quality checks on a malicious repository.
Sanitization: There is no validation or sanitization of the code content before execution.
Command Execution (MEDIUM): The scripts autofix.py and check_quality.py programmatically execute several CLI tools (ruff, mypy, pytest, bandit) via subprocess.run. While they avoid shell=True, they allow execution of system commands based on user-provided path inputs.
Dynamic Execution (MEDIUM): The inclusion of pytest in the core workflow involves the dynamic execution of Python scripts. While standard for development, it constitutes a runtime execution risk when the source of the tests is untrusted.

python