The Agent Skills Directory

[SAFE]: The skill is designed for auditing PHP codebases to identify technical debt, including god classes, circular dependencies, dead code, and duplication. It leverages industry-standard tools like PHPStan, Psalm, and phpcpd for analysis.
[SAFE]: The instructions mandate a read-only audit process, explicitly prohibiting the agent from performing rewrites or code modifications during the audit phase. This constraint minimizes the risk of unintended or destructive actions.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted source code.
Ingestion points: The skill reads PHP source code from the repository (SKILL.md).
Boundary markers: The instructions do not define specific delimiters or "ignore instructions" wrappers for the ingested source code.
Capability inventory: Capabilities are limited to file reading and structural analysis. The skill lacks network-write, file-write, or privilege escalation capabilities.
Sanitization: There is no evidence of sanitization or filtering applied to the ingested content.
Analysis: While the ingestion point exists, the lack of exploitable capabilities ensures that instructions embedded in the analyzed code cannot be used for exfiltration or system modification.

refactoring