The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies and analyzes external source code to generate refactoring reports, which creates a potential surface for instructions hidden in code comments or metadata to influence the agent's output.
Ingestion points: The skill uses Glob, Grep, and Read tools to ingest project files for analysis.
Boundary markers: The skill defines a specific output report format but does not include explicit delimiters or instructions to ignore potential commands embedded within the analyzed source code.
Capability inventory: The skill utilizes Bash execution, AST-based code searching, and external metric tools (radon, pylint) to perform its analysis.
Sanitization: There is no evidence of sanitization or filtering of the ingested code content before it is processed and summarized in the final report.
[EXTERNAL_DOWNLOADS]: The SKILL.md documentation recommends the installation of radon and pylint using pip. These are well-known, standard tools from the official Python Package Index (PyPI) used for code complexity and linting analysis.
[COMMAND_EXECUTION]: The skill includes a shell script (scripts/detect-patterns.sh) that uses mcp-cli to invoke code analysis tools. The script interpolates the project path directly into a JSON payload, which could present a risk if used with paths containing malicious shell or JSON characters.

architecture-single-responsibility-principle