The Agent Skills Directory

[SAFE]: The skill serves as a legitimate auditing utility, using local bash scripts to perform introspection on other command-line tools.
[COMMAND_EXECUTION]: The audit.sh and coverage.sh scripts execute the target binary provided by the user via the --bin argument. This is an intended and documented feature used to verify help text, exit codes, and machine-readable output formats of the audited tool.
[EXTERNAL_DOWNLOADS]: The audit.sh script executes npm view to retrieve metadata from the official NPM registry. This network operation is used solely to verify version consistency between the local development environment and the published registry.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from source files and CLI outputs. It relies on standard string processing tools (grep, awk, sed) and provides clear instructions for the AI agent to manually verify claims of absence and quote evidence, reducing the risk of accidental instruction following from audited data. The severity is assessed as safe within the context of a developer audit tool.

cli-audit