The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests source code from the application's src directory as identified in Step 3 of SKILL.md and scripts/scan-aura-usage.ts. The agent is instructed to manually skim the JSX context to understand component behavior; this process lacks boundary markers or explicit sanitization, potentially exposing the agent to instructions embedded in code comments or strings. The skill operates with a broad capability set including Bash, Write, and WebFetch tools.
[COMMAND_EXECUTION]: As described in Step 1 of SKILL.md, the skill runs a local scanning script using tsx or npx --yes tsx, the latter of which involves executing code fetched from the npm registry.
[EXTERNAL_DOWNLOADS]: The skill fetches design guidelines and component information from https://docs.cognite.com/aura-design-system and https://cognitedata.github.io/flows-community-components/ using the WebFetch tool. These are official vendor resources related to the Aura design system.
[DYNAMIC_EXECUTION]: The scanning script in scripts/scan-aura-usage.ts dynamically loads the typescript compiler library from the audited project's node_modules directory using the NODE_PATH environment variable, as noted in the Step 1 instructions.

aura-review