The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official @codacy/analysis-cli from the npm registry. This is a standard dependency for the tool's operation and originates from a well-known service.
[COMMAND_EXECUTION]: The skill makes extensive use of the codacy and codacy-analysis CLI tools to perform repository discovery and analysis. This includes the use of the --install-dependencies flag during analysis, which may trigger the installation of linting-related plugins required by the project stack.
[DATA_EXFILTRATION]: Configuration data and issue summaries are transmitted to Codacy Cloud (codacy.com) to baseline settings or import the final tuned configuration. This is a core feature of the skill intended to synchronize local and cloud-based code quality standards.
[INDIRECT_PROMPT_INJECTION]: The skill analyzes the project's source code and configuration files, which are considered untrusted data.
Ingestion points: Project source code files processed by static analysis engines in Step 3 and Step 4f.
Boundary markers: The skill uses structured JSON output formats from the underlying CLIs and parses them with jq, ensuring the agent processes data rather than raw text blocks.
Capability inventory: The skill possesses the capability to execute CLI commands and write to the local filesystem (specifically the .codacy/ directory).
Sanitization: Analysis is performed by established static analysis tools (e.g., Semgrep, ESLint) which treat code as data. The skill itself filters these results through specific metrics and logic before presenting them to the user.

configure-codacy