The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/analyze.mjs script accesses local file content via fs.readFileSync using paths provided at runtime. This data is then transmitted to an external API endpoint (https://logic.art/api/agent/analyze) via an HTTP POST request.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret code from external files or user input, which creates a risk that adversarial instructions embedded in that code could influence the agent's behavior.
Ingestion points: The scripts/analyze.mjs script accepts code via the --code argument or reads it directly from the filesystem using the --file argument.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the ingested code strictly as data or to ignore any natural language instructions embedded within it.
Capability inventory: The skill possesses network capabilities (fetch in scripts/analyze.mjs) and file reading capabilities (fs.readFileSync).
Sanitization: The script performs no validation or sanitization of the input content before sending it to the external analysis service.
[EXTERNAL_DOWNLOADS]: The SKILL.md file recommends the use of an external service at https://validate-repo.replit.app for repository-wide scans. This service is hosted on a public platform for user-generated applications and is not associated with a well-known enterprise provider.

code-review