The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions include various shell commands using npm, npx, and node to analyze project configuration, detect installed tools, and run validation checks (e.g., npm run typecheck, npx tsc). These operations are standard for development workflows and project diagnostics.
[INDIRECT_PROMPT_INJECTION]: The skill reads local project files, such as package.json, to adapt its behavior. This creates a surface for indirect prompt injection if the processed project files contain malicious content. However, the risk is inherent to the skill's primary purpose of analyzing codebases.
Ingestion points: The skill reads package.json using node -e and scans the project structure using Glob and Grep commands.
Boundary markers: None present; the skill treats the project metadata as trusted context for analysis.
Capability inventory: The agent can execute shell commands, read/write files via standard development tools, and run tests.
Sanitization: No explicit sanitization of input from project files was found.
[DYNAMIC_EXECUTION]: The skill uses node -e to execute a short JavaScript snippet that parses package.json and prints dependency keys. This is used for environment detection and is restricted to local metadata parsing.
[EXTERNAL_DOWNLOADS]: The skill uses npx to execute tools that may download packages from the public npm registry if they are not already installed locally. The packages specified (e.g., vitest, ts-migrate, typesync) are well-known and standard within the JavaScript ecosystem.

typescript-expert