The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a local Python script (scripts/scan-fallbacks.py) to scan source code for structural patterns. It also calls the vendor's environment verification tool (@howells/envy) using npx. The implementation uses the --no-install flag, which is a security best practice that prevents the tool from downloading potentially malicious third-party packages from public registries if they are not already locally present.- [INDIRECT_PROMPT_INJECTION]: The skill processes external source code from a user-specified repository. While this creates a data ingestion surface where adversarial code could attempt to influence the agent, the analysis is conducted through a deterministic regex-based Python script. The script only identifies specific code smells and does not execute the processed content, effectively mitigating the risk of injection.- [DATA_EXPOSURE]: The included scanning script performs local file reads to identify code patterns. It contains no network communication capabilities, exfiltration patterns, or hardcoded secrets. The tool's behavior is consistent with its stated purpose of auditing code quality.

fail-fast