The Agent Skills Directory

[COMMAND_EXECUTION]: The skill suggests running standard package management commands (e.g., npm ls, npm audit, pip list, cargo tree, go list) to inspect project dependencies. These are legitimate, read-only operations for auditing project structure.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx license-checker, which fetches and executes a well-known community utility for license verification from the npm registry. This is a standard workflow for dependency management.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project manifest files and tool outputs which could theoretically contain deceptive content. However, the risk is inherent to the auditing process and is managed by using standard, established tooling. * Ingestion points: External command outputs from npm audit, license-checker, and others mentioned in SKILL.md. * Boundary markers: None; the skill assumes direct triage of tool output by the agent. * Capability inventory: Shell execution for dependency inspection across multiple ecosystems. * Sanitization: None; the skill relies on the output of standard ecosystem tools.

dependency-audit