The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to verify the behavior and presence of code components ("decisive command output", "require command and result", "Run safe checks for dynamic claims"). Running arbitrary commands based on discovered codebase elements can be risky if the environment is not properly isolated.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and process unfamiliar or "dangerous" code paths and string registrations from external sources while possessing active capabilities.
Ingestion points: Local source files, interface definitions, string registrations, and external consumer data (SKILL.md).
Boundary markers: The skill lacks explicit delimiters for external content; it relies on output-focused instructions to "Map reality" and "Strip prescriptions" rather than input-stage filtering.
Capability inventory: The agent has the ability to read files, write to ~/.agents/artifacts/, execute shell commands, and delete files (SKILL.md).
Sanitization: No evidence of sanitization, escaping, or validation of the ingested code or metadata before processing is present.
[DATA_EXPOSURE]: To perform its primary function, the skill accesses sensitive areas of the codebase, including persistence layers, data state, and configuration files, to generate a durable inventory. While the output is stored locally, this mapping process involves high-level access to the repository's internal architecture.
[NO_CODE]: The skill consists entirely of markdown instructions and does not ship with standalone scripts or executables, relying instead on the agent's native toolset to perform file and command operations.

sus-inventory