The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the analyzed repository and external GitHub issues which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: Stage 1 reads repository configuration files (e.g., .claude/, CLAUDE.md, AGENTS.md) and fetches all open GitHub issues and epics into the context.
Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore' instructions when processing this external content.
Capability inventory: The skill possesses the ability to execute shell commands (via analysis tools) and perform network requests (to fetch issues).
Sanitization: No explicit sanitization or validation logic is mentioned for the ingested repository data or issue descriptions.
[COMMAND_EXECUTION]: The skill executes several command-line tools to perform deterministic code analysis.
Evidence: The playbook.md file instructs the agent to run tools such as knip, ts-prune, vulture, madge, dependency-cruiser, and jscpd to detect dead code and architectural issues.
[EXTERNAL_DOWNLOADS]: The skill uses package runners to download and execute tools from public registries at runtime.
Evidence: The instructions specify using npx <tool> for JavaScript/TypeScript and uvx/pipx run <tool> for Python-based analysis. These downloads target well-known package registries (npm and PyPI) and are consistent with the skill's primary purpose of auditing codebases.
[DYNAMIC_EXECUTION]: The skill describes an orchestration pattern that involves dynamically spawning multiple agent personas to process findings.
Evidence: Stage 2 and the 'Illustrative Workflow sketch' describe using a Workflow tool with parallel() and agent() primitives to execute independent personas (e.g., 'Deletionist', 'Architect') using the Sonnet model.

repo-audit