The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (api_load_tester.py, api_scaffolder.py, database_migration_tool.py) that perform standard developer tasks such as network requests for load testing, code generation from OpenAPI specifications, and SQL schema analysis. These operations are restricted to the local environment and user-specified targets.
[DATA_EXPOSURE_AND_EXFILTRATION]: While the api_load_tester.py script performs network operations, it is a legitimate tool for its stated purpose. No patterns of sensitive file reading or unauthorized data exfiltration were found. Documentation correctly identifies the risk of hardcoding secrets and recommends using environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as OpenAPI specifications and SQL schema files. However, the scripts act as standard CLI tools rather than prompt-driven interfaces, and the generated code follows established safe patterns (e.g., using Zod for input validation and parameterized queries).
[DYNAMIC_EXECUTION]: The api_scaffolder.py script generates code strings that are written to files. This is static code scaffolding based on user-provided templates/specs and does not involve the unsafe evaluation of untrusted strings.

senior-backend