The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill suggests using npx codebase-intelligence@latest to run commands. This action fetches the package from the public npm registry at runtime.
[REMOTE_CODE_EXECUTION]: By recommending npx with the @latest tag, the skill facilitates the execution of remote code that is not pinned to a specific version or integrity hash, allowing the package contents to change independently of the skill definition.
[COMMAND_EXECUTION]: The core functionality of the skill relies on executing the codebase-intelligence CLI and its various subcommands (such as overview, hotspots, and impact) to analyze local file structures.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from local codebases.
Ingestion points: Commands like overview, search, and impact read and analyze files within a user-provided directory path.
Boundary markers: There are no instructions or delimiters provided to the agent to treat file content as untrusted or to ignore embedded instructions within the codebase.
Capability inventory: The skill leverages a CLI tool to map dependencies, calculate risk, and perform keyword searches across the codebase.
Sanitization: The instructions do not specify any sanitization, filtering, or validation of the codebase content before it is processed by the intelligence tool.

codebase-intelligence