The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within a centralized git utility function (scripts/common.py) to execute repository analysis commands such as git log and git rev-parse. These calls are implemented using argument lists to prevent shell injection and are limited to standard repository metadata gathering.
[INDIRECT_PROMPT_INJECTION]: By design, the skill processes untrusted third-party codebases to generate documentation. This creates an attack surface where malicious comments or data in the analyzed code could attempt to manipulate the agent's judgment. The skill mitigates this through a multi-layered approach: automated scripts use HTML escaping for data interpolation, and a specialized linter (scripts/lint_fragments.py) validates that no executable <script> blocks are included in the manual documentation segments.
[EXTERNAL_DOWNLOADS]: The skill's workflow includes instructions for the agent to clone remote repositories via git clone for analysis. This is a core functional requirement for the skill's purpose of auditing external projects.

code-visualization