The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates multiple static analysis tools by executing shell commands. It invokes linters (ESLint, Biome, Ruff, Pylint), type checkers (Pyright, TSC), and security scanners (Semgrep, detect-secrets) through dedicated wrapper scripts.
[EXTERNAL_DOWNLOADS]: Utilizes npx and uvx to dynamically download and execute analysis tools from public registries (NPM and PyPI) at runtime. It also includes a bootstrap script (scripts/eslint-defaults.sh) that installs a specific set of development dependencies, including the sonarjs plugin, into a local directory on first use.
[COMMAND_EXECUTION]: Implements a 'Fix' workflow that can modify project source code by running the project's native auto-fix commands (e.g., npx eslint --fix, ruff check --fix).
[COMMAND_EXECUTION]: The detect-linter.sh script executes arbitrary commands defined in the project's package.json lint scripts when the tool is identified as npm-script.
[PROMPT_INJECTION]: Contains an indirect prompt injection attack surface as it processes untrusted project files and linter outputs to generate reports for the agent.
Ingestion points: Project source files are read during architecture review and complexity analysis in scripts/arch_review/smells.py and scripts/arch_review/graph.py. Tool findings are parsed from CLI output in scripts/arch_review/complexity.py.
Boundary markers: Results are presented to the agent as standard markdown tables without explicit boundary markers or 'ignore' instructions for the content of the findings.
Capability inventory: The skill can execute shell commands via detect-linter.sh and perform file writes during setup or fix workflows.
Sanitization: Findings from external tools are normalized but the content of linter messages and source code snippets is not sanitized before being returned to the agent context.

code-quality