The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local PowerShell commands such as pwsh -NoProfile -Command 'Invoke-ScriptAnalyzer -Path . -Severity Error' for linting and Invoke-Formatter for code formatting. These operations are core to the skill's stated purpose and are performed within the local user context without privilege escalation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of PowerShell scripts (.ps1, .psm1) which could theoretically contain instructions intended to influence the agent. However, the skill treats these files as targets for static analysis tools rather than source instructions for the LLM. It includes explicit guidelines to report failures rather than obeying embedded commands, mitigating common injection risks.
[DATA_EXPOSURE_AND_EXFILTRATION]: No network operations or credential harvesting patterns were found. The skill documentation explicitly states that it does not collect, upload, or store user code or credentials. Access is restricted to project files in the local workspace.
[UNVERIFIABLE_DEPENDENCIES]: The skill references standard PowerShell modules like PSScriptAnalyzer. It contains strict rules against silent tool installations or dependency upgrades, requiring the user to manage the environment and verifying versions before execution.

codeguard-powershell