The Agent Skills Directory

[SAFE]: Detailed analysis of the skill's components (SKILL.md, Python scripts, and documentation) revealed no security vulnerabilities. All activities are local and transparent.
[COMMAND_EXECUTION]: The skill provides a Python script (scripts/flow_metrics.py) for data analysis. The script uses only Python standard libraries and performs purely mathematical calculations and text rendering based on user-supplied input files.
[DATA_EXPOSURE]: The skill processes local data files provided via the --input flag. It does not perform any network operations, and there is no evidence of data exfiltration or unauthorized access to sensitive system files.
[INDIRECT_PROMPT_INJECTION]: The skill includes an attack surface for indirect prompt injection as it processes external issue history data (issues.json). However, the script handles this data strictly as structured JSON for calculation purposes, and the output is presented as formatted text/diagrams without being re-interpreted as agent instructions.
Ingestion points: flow_metrics.py reads a user-specified JSON file.
Boundary markers: None present in the data ingestion logic.
Capability inventory: File read and write operations only. No network, subprocess, or dynamic code execution capabilities.
Sanitization: The script uses standard json.load() for parsing and does not execute or evaluate any content from the input file.

cycle-time-analyzer