The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill executes @shadscan/cli using npx, which fetches and runs code from the public npm registry as part of its core functionality.
[PERSISTENCE]: The setup --pre-commit command allows for the installation of a git hook that automatically executes the scanner during the commit process, establishing a persistent automated check in the local development environment.
[INDIRECT_PROMPT_INJECTION]: The skill uses an iterative 'audit → fix → re-score' loop where findings from the CLI tool are formatted as instructions for other AI agents using the --format prompt flag.
Ingestion points: The skill ingests the output of npx @shadscan/cli, which is based on a static analysis of the local project's source code (SKILL.md).
Boundary markers: The skill relies on the CLI's internal prompt formatting to deliver findings, though it does not explicitly define custom delimiters in the instruction set.
Capability inventory: While the shadscan skill itself focuses on auditing, it is designed to hand off findings to agents like designer (Ridd) and nextjs (Theo) which possess file-writing and code-modification capabilities.
Sanitization: The skill assumes that the CLI tool appropriately filters or sanitizes findings from the scanned codebase before generating the prompt handoff.

shadscan