The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill does not contain any hardcoded credentials or instructions to access sensitive system files. Network operations are limited to standard patterns such as fetching from template APIs (e.g., api.example.com) in documentation examples.
[REMOTE_CODE_EXECUTION]: No patterns involving remote script execution (like curl | bash) or installation of untrusted packages were detected. The skill correctly utilizes Node.js worker_threads for parallel processing with a structured message protocol.
[COMMAND_EXECUTION]: The instructions do not involve spawning shell commands or executing arbitrary code. The use of node:worker_threads is restricted to module-local paths for legitimate task delegation.
[INDIRECT_PROMPT_INJECTION]: The skill defines robust data ingestion patterns (e.g., CSVParser, JsonlParser) and explicitly mandates the use of boundary markers and validation tools like Zod to prevent injection via external data.
Ingestion points: Stream parsers in SKILL.md and references/nodejs-streams-patterns.md process external data chunks.
Boundary markers: The completion criteria and architecture rules mandate Zod validation and error classification for all inputs.
Capability inventory: The skill uses node:fs for local I/O and node:worker_threads for CPU-bound tasks.
Sanitization: Zod is integrated into the error handling and validation logic to sanitize external content at the system boundaries.
[OBFUSCATION]: No obfuscated strings, hidden URLs, or malicious encoding techniques were found. The repetitive nature of the code-organization.md reference file appears to be placeholder content for technical specifications and does not contain hidden instructions.

nodejs-patterns