The Agent Skills Directory

[SAFE]: The skill instructions and associated scripts are focused entirely on the stated purpose of code migration auditing and documentation. No malicious patterns such as prompt injection, obfuscation, or persistence mechanisms were detected.- [COMMAND_EXECUTION]: The skill provides Python scripts (audit_migration_layout.py and scaffold_migration_docs.py) to automate specialized migration tasks. These are invoked locally using python3 with repository-relative paths, which is a standard and secure way to extend the agent's functionality.- [REMOTE_CODE_EXECUTION]: Static analysis flagged the use of subprocess.run in the skill's test files (scripts/tests/test_audit_migration_layout.py and scripts/tests/test_scaffold_migration_docs.py). These calls are used exclusively for unit testing the local Python scripts and do not involve remote code execution or untrusted input.- [DATA_EXFILTRATION]: There is no evidence of unauthorized network activity or credential harvesting. The skill's operations are limited to reading source code and writing documentation within the local project environment.- [PROMPT_INJECTION]: While the skill processes external Java source code (an indirect prompt injection surface), the instructions emphasize structural auditing and documentation rather than execution. The risk is minimal and handled by standard agent guardrails.

rust-java-migration