The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple standard command-line utilities to perform static code analysis and inventory API surfaces.
Evidence: Usage of rg (ripgrep), grep, git status, cargo doc, go list, tsc, and yq across SKILL.md and its associated modules to catalog public functions and types.
[DYNAMIC_EXECUTION]: The workflow involves executing a local Python script to verify the validity of findings.
Evidence: The skill invokes python plugins/imbue/scripts/citation_verifier.py in SKILL.md to ensure that every finding is grounded in verbatim source code anchors.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by scanning source code and documentation in the repository being audited.
Ingestion points: Public symbols, types, and documentation files scanned via rg and grep (SKILL.md, modules/surface-inventory.md).
Boundary markers: None explicitly defined within the shell command output processing.
Capability inventory: Shell command execution and invocation of a Python verification script.
Sanitization: The citation_verifier.py tool acts as a sanitization layer by confirming that all findings correspond to verbatim source code anchors, preventing the inclusion of unverified or hallucinated content in the final report.

api-review