The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/analyze.py and evals/score.py which utilize subprocess.run() for legitimate reconnaissance and scoring tasks. Specifically, it invokes tools like git, tokei, and scc to gather file statistics, hotspot data, and language metrics. These operations are scoped to the local repository path provided by the user and do not incorporate unvalidated external input into shell commands.
[EXTERNAL_DOWNLOADS]: The skill instructions and eval scripts mention standard developer tools and libraries (e.g., npm install @anthropic-ai/claude-code, pip install tree-sitter). All referenced repositories and packages belong to trusted organizations (Anthropic, Google, Vercel) or well-known public registries (npm, PyPI). No downloads from suspicious or untrusted sources were detected.
[DATA_EXFILTRATION]: While the skill performs deep analysis of local source code, the collected data is written to local JSON files (codebase-analysis.json) or markdown files in a wiki/ directory. No network operations were found that would transmit this analysis data to an external server.
[PROMPT_INJECTION]: The SKILL.md contains strict operational constraints and quality tiers to ensure the agent follows a deterministic documentation workflow. There are no patterns suggesting attempts to bypass model safety filters or override system-level instructions.

codebase-onboarding