The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local TypeScript scripts (scripts/doc-paths.ts and assets/check-runbooks.ts) executed via the bun runtime. These scripts perform automated file system operations including scanning the repository with git ls-files, rewriting Markdown links, and validating frontmatter in runbook files. These actions are scoped to documentation management within the repository.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it is instructed to ingest the entire codebase (including source code, configuration, and data models) to generate documentation. Maliciously crafted comments or documentation strings within the target repository could potentially influence the content of the generated sites or the instructions added to AGENTS.md. The skill includes rules requiring the agent to "hand-write" content and verify facts against the code to maintain documentation integrity.
[EXTERNAL_DOWNLOADS]: The instructions guide the agent to install the blume documentation tool and standard dependencies like zod using package managers (npm, bun). These are standard development dependencies required for the site generation functionality.
[DATA_EXPOSURE]: The skill requires the agent to read sensitive repository areas, such as deployment configurations and environment schemas, to ensure documentation accuracy. To mitigate data exposure, the skill includes a "No secrets" hard rule and provides a Vercel middleware implementation (assets/middleware.ts) to enforce HTTP Basic Authentication for the deployed documentation sites.

setup-codebase-docs