The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/verify-commands.sh extracts strings from AGENTS.md markdown files and executes them via bash -c wrapped in a timeout command. This feature is intended to ensure that project-specific documentation remains functional. However, the execution of arbitrary strings parsed from markdown represents a significant security surface. While the script implements an is_safe_command function that blacklists dangerous operations such as rm -rf, sudo, and shell piping, blacklists are inherently incomplete and can often be bypassed by alternative execution methods or obfuscated command construction. This feature should only be utilized on repositories where the documentation content is fully trusted.

agent-rules