The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation requires the user to install a global npm package claude-flow@alpha. This package is not hosted by a recognized trusted organization or well-known service, posing a supply chain risk for an unverified dependency.
[COMMAND_EXECUTION]: The skill extensively utilizes the claude-flow CLI tool to perform local operations, including file system navigation (/goto), git repository management (/commit, /branch, /stash), and test suite execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and analyzing untrusted external content.
Ingestion points: Reads project files, codebases, git diffs, and test results from the local environment (SKILL.md).
Boundary markers: The instructions lack explicit delimiters or safety markers to distinguish between legitimate code and potentially malicious instructions embedded in comments or strings within the processed files.
Capability inventory: The skill has the capability to execute shell commands via the CLI tool, modify files, and interact with version control systems.
Sanitization: There is no mention of sanitization or validation of the content ingested from the project files before it is processed by the AI.

Pair Programming