The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides and instructs the agent to use several local Node.js utility scripts (check-skill-frontmatter.mjs, check-skill-body.mjs, check-skill-references.mjs, check-links.mjs) to enforce structural rules, metadata standards, and link validity within a project's skill directory.
[EXTERNAL_DOWNLOADS]: The link-freshness/check.mjs utility performs outbound network requests using the fetch API to audit the status of external URLs cited in documentation. This is an intentional feature for maintaining link quality.
[INDIRECT_PROMPT_INJECTION]: The skill's auditing tools process data from other files (skills and references), creating a surface for indirect injection if malicious content is placed in the audited files.
Ingestion points: scripts/link-freshness/urls.mjs and scripts/check-links.mjs read and parse Markdown files from the local file system to extract links.
Boundary markers: The auditing logic in scripts/commonmark.mjs explicitly excludes content within fenced code blocks, inline code spans, and HTML comments from being processed as active links.
Capability inventory: The skill uses file system read access and network request capabilities (fetch).
Sanitization: scripts/link-freshness/address-guard.mjs implements robust protection against Server-Side Request Forgery (SSRF) by validating IP addresses before requests. It blocks reserved ranges, including RFC 1918 private networks and cloud provider metadata services (e.g., 169.254.169.254).
[SAFE]: The skill exhibits high security maturity by acknowledging potential risks like DNS rebinding and SSRF in its comments and implementing technical controls to mitigate them.

agent-skill-authoring