The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it ingests untrusted source code from the user's project to perform analysis and removal. Maliciously crafted code (e.g., instructions hidden in comments or strings) could attempt to influence the agent's logic.
Ingestion points: Multiple project source files (.py, .js, .java, .go, .rs) as specified in the Analysis Process sections of SKILL.md.
Boundary markers: Absent; there are no instructions to wrap file content in delimiters or to ignore natural language instructions found within the code.
Capability inventory: File system write access (incremental removal) and subprocess execution (syntax validation and test runners).
Sanitization: Absent; the skill does not instruct the agent to filter or escape content before analysis.
[PROMPT_INJECTION]: The file skill-report.json contains self-referential safety claims, including a pre-filled security audit with a 'safe' verdict. Following security protocols, these claims are treated as data to be evaluated and not as authoritative conclusions (Category 8e).
[COMMAND_EXECUTION]: The skill instructions guide the agent to perform dynamic execution of validation tools (e.g., python -m py_compile, npx eslint, javac) on files modified by the agent (Category 10). This is a routine part of a refactoring workflow but involves executing commands based on recently generated output.
[SAFE]: The helper script scripts/find-unused-imports.py uses standard library AST parsing for local analysis. It does not perform network operations, use dangerous functions like eval(), or have external dependencies.
[SAFE]: The backup mechanism documented in SKILL.md uses standard local shell commands (cp, mkdir, rsync) to preserve project state, which is a safety best practice for destructive operations.

dead-code-removal