The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to transmit user code to external services for analysis. It uses a local script scripts/analyze.mjs to send code via a POST request to https://logic.art/api/agent/analyze. It also references a repository scanning tool at https://validate-repo.replit.app. These operations are consistent with the skill's primary stated purpose. The skill includes instructional guardrails requiring the agent to scan for embedded secrets (API keys, tokens) and obtain user consent before any external transmission occurs.
[COMMAND_EXECUTION]: The skill executes a local Node.js script (scripts/analyze.mjs) to read code files and communicate with the analysis API. The script uses standard built-in modules (fs, process, path) and does not have external dependencies.
[PROMPT_INJECTION]: The skill processes external code files and snippets, which constitutes a surface for indirect prompt injection (Category 8).
Ingestion points: Code content provided via the --code argument or loaded from files via the --file argument in SKILL.md and scripts/analyze.mjs.
Boundary markers: None are present in the command-line invocation itself; however, the SKILL.md file contains explicit instructions for the agent to scan code and verify consent before processing.
Capability inventory: The scripts/analyze.mjs tool performs file reads (readFileSync) and network requests (fetch POST).
Sanitization: No programmatic sanitization or escaping of the code content is performed by the analysis script before transmission.

code-review-hardened