The Agent Skills Directory

[SAFE]: The skill is a standard utility for code analysis. Its operations are limited to local file system reads and execution of trusted tools like ripgrep and git.- [COMMAND_EXECUTION]: The scripts/scan.sh script executes shell commands including rg and git. It correctly utilizes the -- option terminator to prevent argument injection via file paths and validates input paths before execution.- [DATA_EXFILTRATION]: No network communication or exfiltration patterns were detected. The script does not contain any curl, wget, or similar networking commands.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebases and includes snippets of found code in its output ("evidence"). While this presents a surface for indirect prompt injection, it is intrinsic to the primary purpose of a code scanner. The script includes a json_escape function to properly sanitize output for JSON consumption, and the instructions advise the agent to treat matches as advisory findings.- [PROMPT_INJECTION]: No attempts to override agent behavior, bypass safety filters, or extract system prompts were found in the skill instructions or metadata.

typescript-react-smell-detector