The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/extract-extension-config.sh uses php -r to include the ext_emconf.php file from the target extension directory. Because the skill's core workflow instructs the agent to run this extraction script first on any extension path provided by the user, it will execute any arbitrary PHP code contained within that extension's metadata file on the host system.
[INDIRECT_PROMPT_INJECTION]: This skill presents a significant attack surface as it is designed to ingest and analyze untrusted data from third-party TYPO3 extension source code (including PHP classes, TypoScript configuration, and Markdown files).
Ingestion points: Files in Classes/, Resources/, Configuration/, and the root directory (e.g., ext_emconf.php, composer.json).
Boundary markers: None identified; instructions do not include specific delimiters or warnings to ignore instructions embedded in the processed data.
Capability inventory: The skill has the ability to execute shell commands (grep, sed, awk), run PHP scripts, execute Docker containers, and perform network requests via GitHub/GitLab CLI tools.
Sanitization: There is no evidence of sanitization or validation of the content extracted from the project files before it is processed or used in analysis reports.
[EXTERNAL_DOWNLOADS]: The scripts/render_docs.sh script initiates a docker run command for the ghcr.io/typo3-documentation/render-guides:latest image. This reference targets an official repository of the TYPO3 documentation organization, which is recognized as a well-known service. Per the analysis rules, this download is documented neutrally and does not escalate the verdict.
[COMMAND_EXECUTION]: The skill relies on multiple shell scripts (extract-all.sh, analyze-docs.sh, validate_docs.sh) to perform its primary tasks. These scripts execute a wide range of CLI tools on the host system, increasing the risk if the input project paths or file contents are malicious.

typo3-docs