The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a secondary skill definition file from the vendor's official GitHub repository at https://raw.githubusercontent.com/cognitedata/builder-skills/main/skills/code-quality/SKILL.md using curl.
[COMMAND_EXECUTION]: Utilizes Bash to execute multiple auditing tools and shell commands, including grep, find, npm audit, npm outdated, and npx vitest, to inspect the codebase and its dependencies.
[DYNAMIC_EXECUTION]: Employs node -e to run an inline JavaScript script that walks the file system, reads file lengths, and identifies unused production files during the auditing process.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data in the form of repository source code and configuration files. This presents a surface where malicious instructions hidden in the code being reviewed could attempt to influence the agent's findings.
Ingestion points: Source files (.ts, .tsx) and configuration files (vitest.config.ts, package.json) are read and processed by grep and node scripts.
Boundary markers: The skill does not specify delimiters or explicit instructions to ignore embedded prompts within the analyzed files.
Capability inventory: The skill has high privileges including Bash, Grep, Read, and Write capabilities.
Sanitization: There is no evidence of sanitization or escaping of the processed code content before it is included in the final markdown report.

flows-review-checks