The Agent Skills Directory

[SAFE]: The skill is designed for static analysis and QA auditing, prioritizing professional consulting over code implementation. It does not perform network operations or access sensitive system files.
[COMMAND_EXECUTION]: The skill uses the mkdir command to organize its generated reports. The instructions require converting user-provided arguments into URL-safe slugs, which serves as a sanitization step against shell injection or path traversal attempts.
[PROMPT_INJECTION]: The skill processes untrusted codebase data and user-provided target arguments, representing an indirect prompt injection surface. 1. Ingestion points: $ARGUMENTS and the files within the audited project. 2. Boundary markers: No explicit boundary markers or 'ignore' instructions are provided for processed content. 3. Capability inventory: The skill can create directories (mkdir) and write markdown reports to disk. 4. Sanitization: The skill instructs the agent to convert target arguments into URL-safe slugs, providing a basic layer of protection for file system operations. The overall risk is low as the skill generates documentation rather than executable code.

ezra-qa