The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple command-line utilities to analyze source code, including grep for markers, phpmd and phpcpd for PHP analysis, radon and xenon for Python, and package managers like npm, composer, and pip to check for outdated dependencies. These are standard development tools appropriate for the skill's primary purpose.
[EXTERNAL_DOWNLOADS]: Utilizes npx to fetch and execute Node.js packages (complexity-report, jscpd) and references sonar-scanner. These downloads originate from well-known registries and established technology providers, which are considered safe sources.
[DYNAMIC_EXECUTION]: Employs npx for runtime execution of analysis tools. This pattern allows the agent to run code analysis without requiring pre-installed global packages.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted source code from the src/ directory, creating a surface where malicious instructions could be embedded in code comments or files.
Ingestion points: Source code files read by grep, complexity-report, phpmd, radon, xenon, and jscpd in the src/ directory.
Boundary markers: None identified in the prompt instructions to isolate or delimit untrusted code content.
Capability inventory: Shell command execution across multiple languages and file system read/write operations (e.g., creating complexity-report.json).
Sanitization: No explicit sanitization or escaping of file content is specified before the agent processes the analysis output.

tech-debt