The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of a Node.js script (scripts/find-leads.mjs) to analyze the target Rails application. This script identifies potential technical debt by scanning directory structures, measuring file sizes, and searching for specific code patterns (such as SQL interpolation or global state) using regular expressions.
[INDIRECT_PROMPT_INJECTION]: The skill generates reports based on untrusted data from a target Rails codebase, which presents a surface for indirect injection.
Ingestion points: The skill reads source code from the app/ and lib/ directories, as well as configuration files like db/schema.rb and Gemfile via the find-leads.mjs script.
Boundary markers: No specific delimiters or safety instructions are defined to protect the agent from malicious instructions embedded within the audited source code.
Capability inventory: The analysis is restricted to local file reading and regex pattern matching. No network or write operations are performed by the script.
Sanitization: Source code content is not sanitized before being processed by the agent.
[EXTERNAL_DOWNLOADS]: The documentation references external technical resources and books, such as Martin Fowler's PoEAA catalog, the Rails Security Guide, and technical blogs from thoughtbot. These references are used for citing architectural principles and do not involve the execution of remote code.

auditing-rails-tech-debt