The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to run scripts defined within the project's package.json, specifically npm run lint and npm run test:coverage. These scripts are controlled by the codebase being analyzed, meaning a malicious repository can execute arbitrary commands on the user's system when these analysis steps are performed.\n- [REMOTE_CODE_EXECUTION]: Because the skill is configured to auto-invoke and execute scripts from the codebase, it creates a direct path for remote code execution if an agent opens or analyzes an untrusted project containing malicious script definitions.\n- [DATA_EXFILTRATION]: The discovery methodology includes searching for sensitive environment files such as .env and .env.example. Identifying these paths poses a risk of exposing credentials and other secrets to the agent context or output.\n- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes large amounts of untrusted data from the codebase while maintaining active command execution capabilities. This establishes a significant surface for indirect prompt injection attacks.\n
Ingestion points: Files read throughout the codebase mapping and analysis phases using Glob and Read tools (SKILL.md).\n
Boundary markers: Absent. There are no instructions for the agent to ignore or delimit potentially malicious text found within the repository files.\n
Capability inventory: Subprocess execution via npm run and package manager utility calls.\n
Sanitization: Absent. The skill does not escape or validate content retrieved from the analyzed files before reporting findings.\n- [OBFUSCATION]: The file skill-report.json includes a 'security_audit' section that claims the skill is safe and attributes its own findings to false positives. This self-referential content is a technique used to influence security reviews and hide the risks associated with executing repository-controlled scripts.

codebase-analysis