The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses basic filesystem and discovery commands (cat, ls, find) to analyze a repository's tech stack by inspecting common manifest files like package.json, Cargo.toml, and pyproject.toml.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from the local repository (project manifests and markdown files) to inform its documentation generation. While this is an attack surface, the risk is mitigated by the skill's lack of high-privilege execution capabilities.
[EXTERNAL_DOWNLOADS]: The skill references and validates badges from well-known services such as shields.io and github.com. These references are documented as standard practices for project documentation.

readme-best-practices